Vulnerability Management Analyst

Baker McKenzie; Belfast City District; On-site; GBP 45,000 - 75,000; Full time

Job summary

Baker McKenzie is seeking a Vulnerability Management Analyst to analyze, prioritize and drive remediation of security vulnerabilities across the firm's technology estate. You will partner with technology teams to reduce cyber risk and provide risk-based guidance while tracking progress against SLAs.

The role requires strong experience with enterprise vulnerability platforms, threat intelligence, and vulnerability scoring (CWE, CVSS, MITRE ATT&CK).

Qualifications

• Bachelor's degree or substantial equivalent experience.
• CISSP required and GIAC GMON/GVCA
• Microsoft Security certifications SC-900/SC-200
• Security+
• Certified Ethical Hacker

Responsibilities

• Operate and serve as SME in vulnerability management program.
• Perform regular vulnerability scans across applications and infrastructure.
• Validate and prioritise remediation from security tooling.
• Monitor advisories, threat intel, and vendor notifications for remediation.
• Produce dashboards, reports and executive metrics.

Skills

Vulnerability management

Threat intelligence

Vulnerability scoring

Windows

Linux

Networking

Risk-based remediation

Vulnerability dashboards

Executive reporting

SOC experience

Threat landscape awareness

English communication

Education

Bachelor's Degree in Computer Science or equivalent

CISSP

GIAC GMON/GVCA

Microsoft SC-900/SC-200

Security+

Crest Certified Ethical Hacker

Tools

Vulnerability management platforms

Threat intelligence platforms

Job description

The Vulnerability Management Analyst is responsible for analyzing, categorizing, and prioritizing identified security vulnerabilities across the firm's technology infrastructure. Acting as a trusted partner to technology teams, the role will drive vulnerability remediation efforts, provide risk-based guidance, and track remediation progress to help reduce the firm's overall cyber risk exposure

Main responsibilities:

To operate and serve as a subject matter expert in the firm’s vulnerability management program. Perform regular vulnerability scans and across applications and infrastructure. Validate and prioritise remediation of vulnerabilities from the firm’s security tooling. Monitor security advisories, threat intelligence services and vendor notifications for vulnerability remediation.

Skills and experience:

• Expert experience of working with enterprise vulnerability management platforms.
• Working experience with threat intelligence, attack surface mgmt. and exposure mgmt. platforms.
• Expert understanding of vulnerability scoring, including CWE, CVSS and MITRE ATT&CK.
• Foundational knowledge of windows, Linux and networking.
• Ability to assess security risks and prioritise remediation works at enterprise scale.
• Experience in the creation and development of Vulnerability dashboards, reports and executive level metrics.
• Ability to validate the presence of identified vulnerabilities with accuracy and reduce false positive detections.
• Experience of managing vulnerability exceptions, risk acceptance in a large, structured enterprise environment.
• Highly desired experience of working within an enterprise SOC.
• Ongoing commitment to understanding of the threat landscape and common adversary motivations/practices. Ability to quickly adapt practices to evolving circumstances.
• Ability to perform autonomous vulnerability threat research and analysis
• Strong written and oral communication skills. Ability to convey complex concepts to non-technical constituents. Proficiency in oral and written English.
• Capable of providing assistance with the preparation of internal training materials and documentation.
• Ability to be productive and maintain focus to meet firm SLAs on vulnerability remediation.
• Understands Vulnerability Management in the context of risk management and organizational priorities.

Qualifications:

• Possess a Computer Science Bachelor’s Degree or substantial equivalent experience
• CISSP required
• GIAC Vulnerability assessment (GMON/GVCA)
• Microsoft security certification (SC-900, SC-200)
• Security+
• Certified Ethical hacker

Reports to: Security Engineering Manager & Vulnerability Management architect