Cybersecurity Vulnerability Analyst - Level Standard (60% remote, Warsaw) – EU Public Orgs

Twtspain; Warszawa; Híbrido; PLN 264.000 - 396.000; Jornada completa

Descripción de la vacante

Frontex in Warsaw seeks a Cybersecurity Vulnerability Analyst at Level Standard with a strong background in vulnerability management and security testing. The role combines 40% onsite/60% remote work from the Warsaw headquarters, with EU-level responsibilities and a multi-year mission profile.

Excellent knowledge of SDLC, OWASP, and hands-on testing is required. Qualifications include a Bachelor’s degree, 5+ years in relevant roles, and EU security clearance.

Formación

• Knowledge of systems development life cycle.
• Knowledge of operating systems security.
• Knowledge of computer networks security.
• Knowledge of security controls.
• Knowledge of offensive and defensive security practices.
• Knowledge of secure coding practices.
• Hands on experience as Cybersecurity Vulnerability Analyst.
• Knowledge of vulnerabilities, threats, testing, remediation and risk analysis.
• Knowledge of OWASP standards.
• Experience in designing and performing security tests.
• Experience with Tenable, NMAP, Wireshark, BurpSuite.
• Analytical mind with problem-solving skills.

Responsabilidades

• Receive reports about vulnerabilities; analyze and develop response strategies.
• Perform vulnerability assessments and penetration tests; review security compliance.
• Manage vulnerability responses where no countermeasure exists.
• Communicate with vendors and stakeholders; share remediation guidance.
• Evaluate security audits, prioritise findings, and implement controls.
• Provide forensic analysis in security incidents.
• Assess new applications for compliance and configuration baselines.
• Perform vulnerability watch and processing of warnings and reports.
• Oversee known vulnerabilities through established processes.
• Triage based on exposure and impact; validate vulnerabilities on systems.
• Review code and reproduce issues in test environments.
• Notify agency parts about vulnerabilities and mitigations.
• Verify remediation efforts and KPI-based dashboards.
• Conduct regular scans and write improvement-recommendation reports.

Conocimientos

SDLC knowledge

OS security

Network security

Security controls

Offensive security

Secure coding

Vulnerability analyst

Security testing

Penetration testing

Analytical thinking

Stakeholder communication

Issue remediation

KB writing & reporting

Tool proficiency

Educación

Bachelor’s Degree

Herramientas

Tenable

NMAP

Wireshark

BurpSuite

Descripción del empleo

Cybersecurity Vulnerability Analyst - Level Standard (60% remote, Warsaw) – Frontex

Profile: Cybersecurity Vulnerability Analyst - Level Standard- Level Advanced.

Place of performance: 40% onsite/60% remote.On-site service provision at Frontex Headquarters in Warsaw.

Duration of the mission: 46 months.

Security Clearance: EU Personnel Security Clearance is strictly required from the first day of the assignment. – Tier CONFIDENTIEL UE/EU CONFIDENTIAL.

Travel: not foreseen.

Minimum level of education: Level 6 (Bachelor’s Degree required).

Minimum English language skills: B2.

Minimum IT relevant experience: 5 years (3 years in relevant roles).

Award criteria: 65% Quality/35% Price.

Minimum required scoring for interview (%): 70%.

Rate: Flexible. The rate offered depends on the candidate’s level, in accordance with the European public grading system. Further details are available upon discussion.

• NWH: 220 days x 3 years + 185 days in 4th year.
• EWH: 12 days x 4 years + 10 days in 4th year.
• OnCall Duties: 3068 hours x 3 years + 2560 hours in 4th year.

Required technical certificates

At least 2 certifications among:

• [1] [1] GCED (GIAC Certified Entreprise Defender).
• [2] GPPA (GIAC Certified Perimeter Protection Analyst).
• [3] GCWN (GIAC Certified Windows Security Administrator).
• [4] GCUX (GIAC Certified UNIX Security Administrator).
• [5] GCCC (GIAC Certified Critical Controls).
• [6] SSCP ((ISC)2 Certified Systems Security Practitioner).
• [7] GCWN (GIAC Certified Windows Security Administrator).
• [8] GCUX (GIAC Certified UNIX Security Administrator).
• [9] GCCC (GIAC Certified Critical Controls).
• [10] GPEN (GIAC Certified Penetration Tester).
• [11] GXPN (GIAC Certified Exploit Researcher and Advanced Penetration Tester).
• [12] GMOB (GIAC Certified Mobile Device Security Analyst).
• [13] NDS (EC-Council Certified Security and Vulnerability Assessor).
• [14] ECSA (EC-Council Certified Security Analyst).
• [15] GSNA (GIAC Certified Systems and Network Auditor).
• [16] GSEC (GIAC Certified Security Essentials).
• [17] ECSA (EC-Council Certified Security Analyst).
• [18] SCPO (SABSA Certified Security Operations & Service Management Practitioner).
• [19] ECSA (EC-Council Certified Security Analyst).
• Or for any listed above, an equivalent alternative certification recognized internationally (subject to acceptance as a valid credential by the Contracting Authority).

Knowledge and Skills

Knowledge:

• [01] Knowledge of systems development life cycle.
• [02] Knowledge of operating systems security.
• [03] Knowledge of computer networks security.
• [04] Knowledge of security controls.
• [05] Knowledge of offensive and defensive security practices.
• [06] Knowledge of secure coding practices.
• [07] Possesses hands on experience in ICT in the role of Cybersecurity Vulnerability Analyst.
• [08] Knowledge of system security vulnerabilities, threats and exploit mechanisms, penetration testing, remediation techniques and risk analysis methodologies.
• [09] Knowledge of OWASP family standards.
• [10] Practical knowledge of designing and performing security tests.
• [11] practical knowledge of Tenable vulnerability management suite, NMAP, Wireshark, BurpSuite.
• [12] Analytical mind, attention to details and an ability to pick things up quickly; problem solving skills.

Skills:

• [13] Document, report present and communicate with various stakeholders.
• [14] Develop codes, scripts and programmes.
• [15] Identify and exploit vulnerabilities.
• [16] Conduct ethical hacking.
• [17] Think creatively and outside the box.
• [18] Identify and solve cybersecurity-related issues.
• [19] Communicate, present and report to relevant stakeholders.
• [20] Use penetration testing tools effectively.
• [21] Conduct technical analysis and reporting.
• [22] Decompose and analyse systems to identify weaknesses and ineffective controls.
• [23] Review codes assess their security integrate cybersecurity solutions to the organisation’s infrastructure.
• [24] Configure solutions according to the organisation’s security policy.
• [25] Assess the security and performance of solutions.
• [26] Develop and test secure code and/or scripts.
• [27] Identify and troubleshoot cybersecurity-related issues.

Specific requirements

• [01] Experience in vulnerabilities análisis.
• [02] Knowledge of risk assessment in the context of given vulnerability and its environment.
• [03] Experience in coordination and execution of PenTests.
• [04] Experience in the most common types of exploits for web apps.
• [05] Proficient in writing reports covering vulnerabilities and patch management.
• [06] Experience in reviewing current security controls and proposing improvements.
• [07] Experience in writing security procedures/policies with emphasise on information protection and data privacy.
• [08} Experience in administering security solutions - Vulnerability platform, WAF, EDR.
• [09] Innovative approach to new technologies.
• [10] CISSP (Certified Information Systems Security Professional) certificate - non-mandatory, accepted as one of 2 required certificates under V.05 (cell D60).

Typical tasks and responsibilities

• Receiving information and reports about hardware and software vulnerabilities; analysing the nature, mechanics, and effects of the vulnerabilities; and developing response strategies for detecting and repairing the vulnerabilities;
• Proactively managing vulnerabilities by performing vulnerability assessments, penetration tests and reviewing the technical security compliance (deviation from a baseline configuration) of systems and services.
• Managing response to disclosed vulnerabilities for which no countermeasure is yet available.
• This service can involve communicating with vendors, other CSIRTs, technical experts, constituent members, and the individuals or groups who initially discovered or reported the vulnerability.
• Evaluates results of security audits and tests, security findings, prioritises, plans, and implements remediation controls.
• Provides forensic analysis in response to information security incidents.
• Assess security controls of new applications to establish compliance level and appropriate configuration.
• Performing vulnerability watch.
• Processing of incoming vulnerability warnings, alerts and reports.
• Oversee the management of known vulnerabilities through established processes and procedures.
• Triage based on verification, level of exposure and impact assessment.
• Analysing and examining vulnerabilities in hardware or software.
• Validating the existence of suspected vulnerabilities by determining where they are located and how they can be exploited.
• Reviewing source code, using a debugger to determine where the vulnerability occurs, or trying to reproduce the problem on a test system.
• Notifying the various parts of the Agency about the vulnerability and shares information about how to fix or mitigate the vulnerability.
• Verifying that the vulnerability response strategy has been successfully implemented.
• Performing regular vulnerability scans of system and applications, writing reports including recommendations for improvements and following-up the remediation process for identified vulnerabilities.
• Providing regular reports and dashboards (based on KPIs) to monitor security improvements.
• Performing penetration tests and writing reports including recommendations for improvements.
• Reviewing the technical security compliance of systems against defined security baselines (gold configuration), writing reports and following-up the remediation process for identified non-compliance.
• Participating in the definition of security baselines.
• Provide activity reports to management to demonstrate service SLA and service quality.