Manager -Vulnerability Management

Johnson Controls, Inc.; Pune District; Hybrid; INR 2,700,000 - 4,800,000; Full time

Job summary

Johnson Controls, Inc. is seeking a Sr. Vulnerability Analyst to lead the organization’s vulnerability management program. You will identify, evaluate, and mitigate vulnerabilities across IT infrastructure and applications, reporting to the Sr.

Manager Vulnerability Management. Strong leadership and change-management skills are essential. You will drive strategy, oversee assessments and remediation, and collaborate with IT, development, and GIS teams to automate tracking and reporting of

Qualifications

• Minimum 10 years in Information Security and Security Operations.
• Knowledge of vulnerability management practices and CVSS/NIST frameworks.
• Experience with VM platforms: Rapid7, Nessus, Qualys, plus AppSec tools.
• Experience administering ITSM/Vulnerability modules (ServiceNow, Jira).
• Familiarity with OWASP Top 10 and CIS hardening guidelines.
• Cloud security experience across Azure, AWS, Google Cloud.
• Ability to drive change and communicate security concepts clearly.
• Strong analytical, problem-solving, and decision-making skills.

Responsibilities

• Develop and execute a vulnerability management strategy aligned to security objectives.
• Lead and mentor the vulnerability management team and drive professional growth.
• Collaborate with cross-functional teams to embed VM in the overall security program.
• Oversee regular vulnerability assessments and penetration testing activities.
• Work with IT and development teams to implement remediation plans.
• Coordinate infrastructure and web application vulnerability assessments.
• Maintain VM platforms and monitor vulnerabilities across on-premise and cloud.
• Enforce VM processes to secure corporate infrastructure and apps.
• Collaborate with GIS teams to develop automations for tracking/reporting.
• Promote security best practices and standard adherence across the organization.

Skills

Information Security

Security Operations

Leadership

Vulnerability Management

Program Management

Communication Skills

Change Management

Risk Assessment

Cross-functional Collaboration

Security Governance

Education

Bachelor’s degree in computer engineering

Tools

Rapid7 Insight VM

Nessus

Qualys VM

Burp Suite

ZAP

ServiceNow SecOps VM

Jira

Job description

What you will do:

The Johnson Controls Global Cyber Security (GCS) team is undergoing a transformation and expansion as Johnson Controls increases its cybersecurity resources and capabilities in order to address the ever‑changing cybersecurity threat landscape.

The Sr. Vulnerability Analyst for Vulnerability Management will be responsible for overseeing and leading the vulnerability management program within the organization. This role involves identifying, evaluating, and mitigating security vulnerabilities across the company's IT infrastructure and applications. The ideal candidate will have a deep understanding of cybersecurity principles, strong leadership skills, and a proven track record of managing vulnerability management teams and programs. This role will report to the Sr. Manager Vulnerability Management.

The candidate will be able to articulate thoughts clearly, run operations, plan initiatives, and execute with appropriate urgency. The candidate will demonstrate drive, intelligence, maturity, and energy and will be a proven change agent.

How you will do it:

• Develop and execute a comprehensive vulnerability management strategy aligned with the organization’s security objectives.
• Lead and manage the vulnerability management team, providing guidance, mentorship, and professional development opportunities.
• Collaborate with cross‑functional teams to integrate vulnerability management processes into the overall security program.
• Oversee regular vulnerability assessments and penetration testing to identify potential security weaknesses.
• Work closely with IT and development teams to develop and implement effective remediation plans.
• Coordinate and/or perform regular Infrastuctural and Web Application vulnerability assessments;
• Identify, and maintain the vulnerability management corporate platform in order to prompt identify weakness in the internal and external perimeter, including Cloud infrastructure;
• Monitor the identified security vulnerabilities or missconfiguration and support the IT stakeholders for remediation;
• Enforce VM processes and procedures to ensure also the right coverage and security of the Corporate Business Infrastructure and Web Applications;
• Collaborate with GIS teams to develop or optmize automations used for vulnerability tracking and reporting;
• Support to adopt Secutiy best practices and security standards applied by the organization.

What we look for:

Required

• Minimum 10 years working in Information Security and Security Operations area.
• Knowledge of industry best practices in Vulnerability Management and Compliance areas; (e.g. NIST and “CVSS - Common Vulnerability Scoring System” frameworks)
• Experience in management and configuration of vulnerability assessment platform (e.g Rapid7 Insight VM and AppSec, Nessus, Qualys VM and WAS, Burp Suite, ZAP)
• Experience with administration of ITSM solutions used for vulnerability tracking and reporting (Service Now SecOps VM Module/Jira)
• Experience with OWASP Top 10 assessment and methodology and CIS hardening standard;
• Experience with various cloud providers (Azure, Google, Amazon) and knowledge on methodology how to secure them;
• Experience on enforcement of VM operational Security process and procedures;
• Experience with penetration test assessment, red/blue team activities and security monitoring;
• Excellent verbal, written, and interpersonal communications skills, including the ability to communicate security concepts to both technical and non‑technical audiences.
• Demonstrated ability to effectively facilitate and drive organizational change.
• Strong verbal and written communication skills.
• Excellent analytical, problem‑solving, and decision‑making skills.
  

Preferred

• Bachelor’s degree in computer engineering, computer security or computer science discipline;
• Previous technical background in IT or Software development roles;
• Experience with management of Service NOW SecOps Vulnerability Response module.
  

Desired Security certifications:

• Certified Information Systems Security Professional (CISSP)
• Certified Ethical Hacker (CEH)
• Offensive Security Certified Professional (OSCP)
• CompTIA Security+
• Qualys Certified Specialist
• Burp Suite Certified Practitioner