Sr Cybersecurity Analyst

IQVIA; Oeiras; On-site; EUR 90,000 - 130,000; Full time

Job summary

IQVIA is seeking a senior security professional to lead Vulnerability Management, External Attack Surface Management, CTEM and penetration testing oversight. You will drive risk-based prioritization, remediation tracking, and closure validation while coordinating testers and reporting to senior leadership.

The role requires strong CVSS/EPSS knowledge, cloud and OS expertise, and CISSP/CISM/CRISC certifications, with English fluency and leadership capabilities.

Qualifications

• Bachelor's Degree in Computer Science, a related field, or equivalent experience – Required
• Equivalent work experience may substitute for degree – Preferred
• 5 years of related work experience, including 3 years in vulnerability or exposure management – Required
• Fluent English, written and spoken – Required
• Hands-on experience with: Vulnerability Management / risk-based VM platforms; External Attack Surface Management (EASM); Exposure Management / CTEM platforms; Threat Intelligence Platforms (TIP); Cloud Security Posture Management (CSPM/CNAPP); Breach and Attack Simulation (BAS) or other exposure validation tools; IT Service Management (ITSM) and CMDB for remediation workflows – Required
• Strong knowledge of CVSS, EPSS, known-exploited vulnerability catalogs, MITRE ATT&CK and OWASP Top 10 – Required
• Working knowledge of at least one major public cloud provider, networking, Windows and Linux – Required
• Scripting or API automation (Python, PowerShell) and data reporting / BI tools – Preferred
• CISSP – Certified Information Systems Security Professional – Required
• CISM – Certified Information Security Manager – Required
• CRISC – Certified in Risk and Information Systems Control – Required
• Technical certification such as GIAC (GEVA, GCED, GPEN), OSCP, CompTIA PenTest+ or a cloud security certification – Preferred

Responsibilities

• Provide subject matter expertise on Vulnerability Management, External Attack Surface Management, CTEM and Penetration Testing oversight.
• Manage operation of VM, EASM and CTEM capabilities from asset discovery to remediation tracking and closure validation.
• Lead analysts, act as escalation point for complex exposures.
• Oversee governance development: SOPs, remediation SLAs, risk-acceptance workflows, KPIs.
• Coordinate penetration testing scope, engage testers, review reports, drive remediation and retest.
• Correlate threat intel with exposure data to prioritize exploitable risks.
• Provide performance updates and exposure risk reporting to Senior Leadership.
• Act as Subject Matter Expert for complex / high-impact issues.

Skills

Fluent English

Python

PowerShell

Scripting / API automation

Data reporting / BI tools

Cloud providers knowledge

Networking knowledge

Windows & Linux

CVSS/EPSS knowledge

MITRE ATT&CK

OWASP Top 10

BAS / exposure validation tools

ITSM / CMDB workflows

Public cloud platforms

Breach and Attack Simulation

KPI reporting

CISSP

CISM

CRISC

GIA / GIAC certifications (GEVA/GCED/…

Education

Bachelor's Degree in Computer Science or related field

Equivalent work experience may substitute for degree

Tools

Vulnerability Management platforms

External Attack Surface Management

CTEM platforms

Threat Intelligence Platforms

CSPM/CNAPP

BAS / exposure validation tools

ITSM

CMDB

Job description

Provides subject matter expertise on and oversight of the Vulnerability Management, Attack Surface Management, Continuous Threat Exposure Management (CTEM) and Penetration Testing oversight capabilities.

Essential Functions

• Manage the operation of the Vulnerability Management, External Attack Surface Management and CTEM capabilities, from asset discovery and scanning through risk-based prioritization, remediation tracking and closure validation.
• Provide leadership and direction to analysts within the area of responsibility; act as escalation point for complex, contested or zero-day exposures.
• Oversee the development and implementation of functional governance (Standard Operating Procedures, remediation SLAs, risk-acceptance and exception workflows, Key Performance Indicators).
• Act as controller of the penetration testing program: define scope and rules of engagement, coordinate internal and third-party testers, review report quality, and drive findings through remediation and retest.
• Correlate threat intelligence with internal and external exposure data to prioritize remediation on what is exploitable and business-critical.
• Provide regular performance updates and exposure risk reporting to Senior Leadership.
• Act as Subject Matter Expert, working on issues where analysis of situations or data requires detailed knowledge of the area of responsibility.

Qualifications

• Bachelor's Degree in Computer Science, a related field, or equivalent experience – Required
• Equivalent work experience may substitute for degree – Preferred
• 5 years of related work experience, including 3 years in vulnerability or exposure management – Required
• Fluent English, written and spoken – Required
• Hands-on experience with: Vulnerability Management / risk-based VM platforms; External Attack Surface Management (EASM); Exposure Management / CTEM platforms; Threat Intelligence Platforms (TIP); Cloud Security Posture Management (CSPM/CNAPP); Breach and Attack Simulation (BAS) or other exposure validation tools; IT Service Management (ITSM) and CMDB for remediation workflows – Required
• Strong knowledge of CVSS, EPSS, known-exploited vulnerability catalogs, MITRE ATT&CK and OWASP Top 10 – Required
• Working knowledge of at least one major public cloud provider, networking, Windows and Linux – Required
• Scripting or API automation (Python, PowerShell) and data reporting / BI tools – Preferred
• CISSP – Certified Information Systems Security Professional – Required
• CISM – Certified Information Security Manager – Required
• CRISC – Certified in Risk and Information Systems Control – Required
• Technical certification such as GIAC (GEVA, GCED, GPEN), OSCP, CompTIA PenTest+ or a cloud security certification – Preferred

IQVIA is a leading global provider of clinical research services, commercial insights, and healthcare intelligence to the life sciences and healthcare industries. We create intelligent connections to accelerate the development and commercialization of innovative medical treatments to help improve patient outcomes and population health worldwide. Learn more at https://jobs.iqvia.com.

IQVIA is committed to integrity in our hiring process and maintains a zero tolerance policy for candidate fraud. All information and credentials submitted in your application must be truthful and complete. Any false statements, misrepresentations, or material omissions during the recruitment process will result in immediate disqualification of your application, or termination of employment if discovered later, in accordance with applicable law. We appreciate your honesty and professionalism.

At IQVIA, we believe that diversity, inclusion, and belonging empower our mission to accelerate innovation for a healthier world. We create a culture of belonging by valuing the perspectives of all talented employees worldwide and providing them with the opportunity to power smarter healthcare for everyone, everywhere. When our talented employees bring their authentic selves and their diverse experiences to work, they enable us to accomplish extraordinary things. Multifaceted thought processes spark innovation. Multi-talented collaboration harnesses innovation to deliver superior outcomes. Likewise, as part of this culture, IQVIA is committed to ensuring effective equality between women and men, integrating it as a strategic principle in its corporate and human resources policies.