TECHNICAL LEAD - Vulnerability Assessment

Happiest Minds Technologies; Bengaluru; On-site; INR 1,500,000 - 2,500,000; Full time

Job summary

Happiest Minds Technologies is seeking a Vulnerability Management Analyst/Engineer with 5-8 years of cybersecurity experience. The role involves identifying, analyzing, prioritizing, and driving remediation of security vulnerabilities across networks, cloud, and applications.

You will collaborate with infrastructure, DevOps, cloud, and security teams to reduce risk and improve security postures through structured remediation and reporting.

Qualifications

• 5-8 years of experience in Vulnerability Management, Security Operations, or Cybersecurity.
• Understanding of CVSS, CVE, CWE, OWASP Top 10, MITRE ATT&CK.
• Hands-on with Nessus, Qualys VMDR, Rapid7 InsightVM, Defender Vulnerability Management, ServiceNow VR.
• Knowledge of Windows, Linux, Active Directory, databases, and networking.
• Cloud security concepts (AWS, Azure, GCP) and SAST/DAST familiarity.

Responsibilities

• Conduct vulnerability assessments across networks, servers, endpoints, databases, web apps, cloud, and containers.
• Analyze findings, validate weaknesses, and prioritize based on CVSS and business impact.
• Lead remediation plans with infrastructure, app, and DevOps teams; track SLAs.
• Prepare risk dashboards, executive summaries, and remediation metrics.
• Assist in governance, risk acceptance, and automation initiatives.

Skills

Vulnerability Mgmt

Security Operations

Vulnerability Assessment

CVSS Scoring

CVE / CWE

OWASP Top 10

MITRE ATT&CK

Nessus

Qualys VMDR

InsightVM

Defender VM

ServiceNow VR

Windows

Linux

Cloud Security

Tools

Nessus

Qualys VMDR

Rapid7 InsightVM

Defender for Endpoint

ServiceNow Vulnerability Response

Job description

Vulnerability Management Analyst / Engineer

Job Summary

We are seeking a highly motivated Vulnerability Management (VM) Analyst/Engineer with 5-8 years of experience in cybersecurity, vulnerability management, and risk remediation. The candidate will be responsible for identifying, analyzing, prioritizing, and driving remediation of security vulnerabilities across enterprise infrastructure, applications, cloud environments, and code repositories.

The role requires strong technical assessment capabilities, risk-based prioritization expertise, remediation tracking, and effective collaboration with infrastructure, application, DevOps, cloud, and security teams to reduce organizational cyber risk.

Key Responsibilities

Vulnerability Assessment & Analysis

• Conduct vulnerability assessments across networks, servers, endpoints, databases, web applications, cloud environments, and containerized workloads.
• Analyze findings from vulnerability scanning tools and validate security weaknesses.
• Identify vulnerabilities across operating systems, applications, middleware, cloud platforms, APIs, and source code.
• Evaluate vulnerabilities for exploitability, business impact, and potential operational risks.Perform technical analysis of security findings and determine root causes.
• Prioritize vulnerabilities using CVSS scores, threat intelligence, exploit availability, asset criticality, and business impact.
• Classify vulnerabilities based on severity and risk exposure.
• Support risk-based vulnerability management processes and reporting.
• Identify critical security exposures requiring immediate remediation or mitigation.
• Assist in developing risk acceptance, exception management, and compensating control recommendations.

Remediation Management

• Work closely with infrastructure, application, cloud, and development teams to drive remediation activities.
• Translate technical vulnerabilities into actionable remediation plans, patch requirements, and security recommendations.
• Track remediation progress and ensure closure within agreed SLAs.
• Validate remediation effectiveness through rescanning and verification testing.
• Develop remediation workflows and escalation mechanisms for overdue vulnerabilities.

Technical Security Assessments

• Review security weaknesses across:
  • Network Infrastructure
  • Servers & Endpoints
  • Cloud Platforms (AWS, Azure, GCP)
  • Web Applications and APIs
  • Containers and Kubernetes Environments
  • Source Code and CI/CD Pipelines
• Conduct vulnerability triage and false-positive analysis.
• Assess technical controls and recommend security hardening measures.

Reporting & Communication

• Prepare vulnerability assessment reports, risk dashboards, and executive summaries.
• Present risk findings and remediation status to stakeholders.
• Coordinate with cross-functional teams to address security gaps.
• Facilitate discussions between business, IT operations, application owners, and security teams.
• Communicate technical risks in business-friendly language.

Process Improvement

• Contribute to the enhancement of vulnerability management processes and workflows.
• Support automation initiatives for vulnerability identification, prioritization, and reporting.
• Assist in defining remediation SLAs and governance metrics.
• Monitor emerging threats and vulnerabilities impacting the organization.

Required Skills & Experience

Technical Skills

• 5-8 years of experience in Vulnerability Management, Security Operations, Vulnerability Assessment, or Cybersecurity Operations.
• Strong understanding of:
  • Vulnerability Management Lifecycle
  • CVSS Scoring Methodology
  • Common Vulnerabilities and Exposures (CVE)
  • Common Weakness Enumeration (CWE)
  • OWASP Top 10
  • MITRE ATT&CK Framework
• Hands-on experience with one or more:
  • Tenable Nessus/Tenable.SC
  • Qualys VMDR
  • Rapid7 InsightVM
  • Microsoft Defender Vulnerability Management
  • ServiceNow Vulnerability Response
• Knowledge of Windows, Linux, Active Directory, databases, and networking.
• Understanding of cloud security concepts (AWS, Azure, GCP).
• Familiarity with SAST, DAST, and code security assessment tools.
• Experience in remediation validation and vulnerability verification.

Security Knowledge

• Security hardening standards and best practices.
• Patch management processes and technologies.
• Exposure to security frameworks such as:
  • ISO 27001
  • NIST Cybersecurity Framework
  • CIS Benchmarks
  • PCI DSS (preferred)

Preferred Qualifications

• CEH, Security+, CySA+, SC-200, SC-100, or equivalent certifications.
• Experience with vulnerability orchestration and automation workflows.
• Familiarity with threat intelligence platforms.
• Exposure to DevSecOps and secure software development practices.
• Experience with ServiceNow Vulnerability Response workflows.