Cyber Threat Exposure Management Analyst

Version 1; Bengaluru; On-site; INR 1,800,000 - 2,600,000; Full time

Job summary

Version 1 is seeking a Cyber Threat Exposure Management Analyst to support our exposure management programme across the estate. The role spans vulnerability management, attack surface management, cloud security posture, and secure development practice.

You will own end-to-end vulnerability lifecycle activity, maintain prioritised exposure views, and communicate risk clearly to internal stakeholders. You operate with limited supervision, take ownership, and consistently deliver to a high standard

Qualifications

• Experience owning the end-to-end vulnerability lifecycle.
• Ability to apply CVSS, EPSS, and business context for remediation.
• Familiarity with ISO 27001 and NIST CSF frameworks.

Responsibilities

• Maintain inventory of internet assets, domains, certificates, and cloud services.
• Operate EASM/CAASM tooling to surface unowned assets and route ownership.
• Enrich findings with threat intel and KEV trends for prioritisation.
• Identify gaps in asset coverage and propose improvements with initiative.
• Own end-to-end vulnerability lifecycle from discovery to closure.
• Apply CVSS/EPSS and business context to set remediation SLAs.
• Work with CSPM to reduce cloud misconfigurations across AWS/Azure/OCI.
• Embed security requirements and threat modelling into the SDLC.

Skills

Vulnerability management

Attack surface management

Cloud security

Threat intelligence

ISO 27001

NIST CSF

Tools

EASM

CAASM

Job description

Cyber Threat Exposure Management Analyst

• Full-time
• Department: Business Support

Version 1 has celebrated30 yearsinbusinessand continues to be trusted by global brands to delivertechnology and transformationsolutions that drive customer success. Ourdeepexpertiseenables our customers to navigate the rapidlyevolving technology landscape. We foster strong partnerships withglobal technology leadersincluding Microsoft, AWS, Oracle, Red Hat,OutSystems, Snowflake, ensuring that our customers are provided with the highest quality solutions and services.

We’rea award-winning employer reflecting how our employees are at the very heartof whatwe do:

• 10+ years as a Great Place to Work in Ireland & UK
• Best Workplace for Women in the UK & Ireland by GPTW
• Best Workplace for Wellbeing in the UK by GPTW

We’rea corevalues drivencompany, we hire people who share our values, and we reward those who display and foster them,it’sdeeply embedded within our DNA. Invest in us andwe’llinvest in you!.

We are seeking a Cyber Threat Exposure Analyst to support our exposure management programme across the estate. The role spans vulnerability management, attack surface management, cloud security posture, and secure development practice. Working as a fully contributing team member, you will own end-to-end vulnerability lifecycle activity, maintain prioritised exposure views, and communicate risk clearly to internal stakeholders. You operate with limited supervision, take clear ownership of your assignments, and consistently deliver to a high standard of quality.

Key Responsibilities

• Maintain a continuous inventory of Internet-facing assets, shadow IT, domains, subdomains, certificates, cloud services, APIs, and third-party-hosted assets.
• Operate EASM/CAASM tooling to surface unowned or unmanaged assets and route them to the correct owner.
• Enrich attack surface findings with threat intelligence, active exploitation trends, and KEV data to support prioritisation.
• Proactively identify gaps in asset coverage and bring forward improvement ideas without waiting to be directed.

Vulnerability Management

• Own the end-to-end vulnerability lifecycle: identification, risk-based triage, remediation tracking, and closure validation.
• Apply CVSS, EPSS, and business context to set remediation SLAs and escalation paths.
• Maintain vulnerability management policies, standards, and reporting cadence aligned to ISO 27001 and NIST CSF.
• Break down complex vulnerability backlogs into prioritised, actionable components and drive them to closure with minimal supervision.

Cloud Security Posture Management (CSPM)

• Monitor cloud misconfigurations, identity risk, and posture drift across AWS, Azure, and OCI.
• Partner with cloud platform teams to remediate CSPM findings and reduce recurring misconfiguration classes.
• Extend CSPM coverage as new cloud services, apps, and workloads are onboarded.
• Build and maintain strong working relationships with platform and engineering teams; negotiate remediation timelines and handle pushback constructively.

CTEM / Exposure Management

• Operate the Scope, Discover, Prioritise, Validate, and Mobilise phases of the CTEM programme.
• Consolidate attack surface, vulnerability, and posture data into a single exposure view for stakeholders.
• Track and report exposure reduction metrics against agreed KPIs, maintaining accurate and well-organised records across all workstreams.

Secure SDLC

• Embed security requirements, threat modelling, and secure code review checkpoints into the SDLC.
• Work with engineering teams to reduce vulnerability injection at source rather than relying only on downstream remediation.
• Maintain secure