Devoteam Cyber Trust | Vulnerability Manager | Retail & E-commerce Sector

Devoteam; Porto; On-site; EUR 60,000 - 90,000; Full time

Benefits offered by this job

Professional development

Growth opportunities

Collaborative culture

Job summary

Devoteam Cyber Trust in Porto, Portugal, is seeking a Vulnerability Manager to join the Threat Operations team within the Retail & E-commerce sector.

You will own the vulnerability lifecycle across infrastructure and endpoints, define remediation SLAs, monitor progress, and produce dashboards and KPIs for management. Collaboration with AppSec, Cloud Security, and Infra teams is expected.

Candidates should have solid knowledge of CVE/CVSS, SSDLC, and experience in prioritization and reporting.

Qualifications

• Fundamental knowledge of Vulnerability Management concepts (CVE, CVSS, KEV).
• Experience defining SLAs and tracking remediation activities.
• Knowledge of End-of-Life / End-of-Support risk assessment.
• Ability to create dashboards and interpret KPIs.
• Familiarity with SSDLC, SCA/SAST concepts.

Responsibilities

• Manage the vulnerability lifecycle across infrastructure and endpoints.
• Prioritize issues using CVE, CVSS, KEV and business context.
• Define remediation SLAs and monitor progress.
• Validate remediation or mitigation, escalate SLA breaches.
• Monitor vulnerabilities in development pipelines with AppSec.
• Assess risk of technology obsolescence across systems.
• Analyze security findings in cloud, containers, and images with AppSec and Cloud Security teams.
• Validate security tool results, investigate false positives.
• Produce dashboards, KPIs and weekly status updates for management.
• Automate and document procedures within the Vulnerability Management Program.

Skills

Vulnerability Management

SLA Definition

Dashboard & KPIs

Cloud Security

SSDLC

Tools

Tenable One

CrowdStrike FEM

Azure

Google Cloud

SCA/SAST

Job description

Devoteam Cyber Trust | Vulnerability Manager | Retail & E-commerce Sector

• Full-time

Devoteam Cyber Trust is the specialized cybersecurity unit of the Devoteam Group. With over 800 experts across the EMEA region, our mission is to position cybersecurity as a business enabler, not a barrier. We take a comprehensive approach to Cyber Resilience, Applied Security, and Security Service Management to safeguard the digital journey of large and mid-sized enterprises across all sectors and industries.

Since 2009, previously known as INTEGRITY, our Portugal-based team has specialized in delivering cutting-edge Managed Security Services. By combining expertise with proprietary technology, we consistently and effectively reduce our clients' cyber risk. Our wide range of services includes Persistent Penetration Testing, ISO 27001, PCI-DSS, GRC Consulting and Solutions, and Third-Party Risk Management. Certified in ISO 27001 (Information Security) and ISO 9001 (Quality), PCI-QSA, and members of CREST and CIS (Center for Internet Security), we serve a significant number of clients in over 20 countries.

Integration into a Threat Operations team, with responsibilities within the organization's Vulnerability Management Program, including vulnerability identification, prioritization, remediation SLA definition and tracking, and reporting.

• Manage the vulnerability lifecycle across infrastructure and endpoints, including analysis, prioritization (CVE, CVSS, KEV, exploitability, business context), and definition of remediation SLAs.
• Monitor and validate remediation or mitigation processes, identify SLA breaches, perform follow-ups, and elevate issues to the appropriate teams or management levels.
• Identify and monitor vulnerabilities within development pipelines (SSDLC), in coordination with the AppSec team.
• Assess and monitor the risk associated with technology obsolescence (End-of-Life / End-of-Support) across systems, applications, and components.
• Identify and analyze security findings across cloud environments, containers, and images, in collaboration with AppSec and Cloud Security teams.
• Critically validate the results generated by security tools, investigating false positives and confirming vulnerabilities.
• Ensure adequate coverage of the vulnerability management platform across the asset estate, in coordination with Infrastructure and Workplace teams.
• Produce vulnerability dashboards, KPIs, and reporting, including weekly status updates on critical vulnerabilities and remediation SLAs for management.
• Automate, document, and standardize operational procedures within the Vulnerability Management Program.

Vulnerability Management

• Fundamental knowledge of Vulnerability Management concepts, including CVE, CVSS, KEV, exploitability, severity, prioritization, and remediation.
• Experience defining SLAs, monitoring remediation activities, conducting follow-ups, and escalating issues.
• Knowledge of technology obsolescence (EOL/EOS) and associated risk assessment.
• Experience creating dashboards and reports, with the ability to define and interpret KPIs.
• Knowledge of cloud security and cloud resources, including security findings analysis.
• Knowledge of container and container image vulnerabilities.
• Familiarity with the Secure Software Development Lifecycle (SSDLC) and SCA/SAST concepts.
• A critical approach to security tool results, with the ability to validate findings rather than assuming they are automatically accurate.

Technical Knowledge

• Windows and Linux operating systems.
• Networking and protocols: TCP/IP, DNS, HTTP/HTTPS, ports, and services.
• Vulnerability Management platforms: Tenable One, CrowdStrike FEM.
• Cloud platforms, particularly Microsoft Azure and Google Cloud.
• Security tools integrated into development pipelines, including SCA, SAST, and IaC scanning.

Soft Skills

• Effective communication with technical and operational teams.
• Ability to communicate with different levels of the organization, including management, translating technical information into business risk and impact.
• Strong analytical and problem-solving skills.
• Autonomy, organization, and prioritization skills in a high-volume vulnerability environment involving multiple teams.

Certifications

Certifications in cybersecurity and Vulnerability Management are considered an advantage, particularly:

• GIAC Enterprise Vulnerability Assessor (GEVA) — SANS SEC460.
• CompTIA CySA+ or CompTIA Security+.
• Cloud security certifications, such as Microsoft AZ-500 or Google Professional Cloud Security Engineer.
• Vendor certifications related to vulnerability scanning and management tools.

What we offer:

• Professional development and monitoring talent;
• Commitment to our employees' development;
• Collaboration in a company that is constantly growing and evolving;
• Strong organizational culture: collaboration, sharing, flexibility, integrity and low ego.

The Devoteam Group works for equal opportunities, promoting its employees based on merit and actively fights against all forms of discrimination. We are convinced that diversity contributes to the creativity, dynamism and excellence of our organization. All of our vacancies are open to people with disabilities.