Senior Vulnerability & Exposure Analyst

Role summary

You will decide which exposures actually matter and make sure they get fixed. Instead of chasing scanner counts, you will judge real exploitability, factor in compensating controls, and drive remediation with engineering teams across Azure infrastructure, AKS containers, web applications and code. You will also lead how we handle two new pressures from frontier AI: securing AI and LLM applications, and keeping pace as AI-assisted research shortens the time from disclosure to exploit.

Key responsibilities

Exposure management and prioritization

• Run a continuous threat exposure management (CTEM) cycle: scope, discover, prioritize, validate, mobilize.
• Consolidate findings from Qualys / Tenable / Rapid7, Azure-native security services, container image scans and code/SCA tools into one risk view.
• Prioritize by real-world risk: CVSS v4 base and threat metrics, EPSS, CISA KEV, threat intelligence, asset criticality (patient-data and GxP systems first), reachability and attack-path context.
• Categorize risk consistently (critical / high / medium / low with defined SLAs) and keep the risk register current.

Exploitability and compensating controls

• Validate exploitability hands-on: confirm whether a vulnerable path is reachable, authenticated or internet-exposed, and test proofs-of-concept safely where needed.
• Assess and document compensating controls (WAF rules, segmentation, NSGs, private endpoints, EDR protections, Azure Policy, hardening) and their effect on residual risk.
• Approve, time-box and track risk exceptions with clear owners and expiry dates.

Cloud, containers and WAF

• Assess Azure configuration and exposure: identity, network, storage, Key Vault, PaaS services and public endpoints.
• Secure AKS and ACR: image scanning, base-image hygiene, Kubernetes RBAC, admission policies (Azure Policy / Gatekeeper), CIS benchmarks and runtime risks.
• Write, tune and review Azure WAF policies on Front Door and Application Gateway: managed rule sets (OWASP CRS / DRS), custom rules, rate limiting, bot protection, exclusions and the move from detection to prevention mode.
• Use WAF virtual patching to reduce exposure while permanent fixes are built.

Application and supply chain

• Triage SCA and code-scanning findings with development teams; generate and use SBOMs (CycloneDX/SPDX) and VEX statements.
• Respond quickly to high-impact open-source vulnerabilities across the software estate.

Frontier AI

• Secure AI and LLM workloads (for example, Azure OpenAI / Azure AI Foundry applications): assess prompt injection, data leakage, insecure output handling, excessive agent permissions and model supply-chain risk, using OWASP Top 10 for LLM Applications and MITRE ATLAS.
• Adapt the program to AI-accelerated discovery and exploitation: shorter SLAs for critical issues, faster triage, and AI-assisted tooling where it helps analysts keep pace.

Remediation ownership and reporting

• Own remediation to closure: raise tickets with clear fix guidance, agree timelines with owners, verify fixes and escalate overdue risk.
• Report exposure trends, SLA performance and top risks to security leadership in business terms.

Must-have skills

• 10+ years in security, with hands-on vulnerability and exposure management in enterprise environments.
• Deep experience with at least one of Qualys, Tenable or Rapid7, plus Azure-native security tooling.
• Strong grasp of exploitability: CVSS v4, EPSS, KEV, attack paths, and how attackers chain vulnerabilities.
• Hands-on Azure security, AKS/container security and Azure WAF policy tuning.
• Ability to read code and exploit write-ups, and give developers precise fix guidance.
• Proven record of driving remediation across teams you do not manage.

Good to have

• Penetration testing or red-team background.
• AI/LLM application security experience.
• CNAPP or attack-path tooling, and healthcare/GxP validated systems.
• Scripting (Python, PowerShell, KQL) for data correlation and reporting.
• Certifications: AZ-500, CKS, OSCP, GWAPT, GPEN, CISSP, or equivalent.
• Looking for Immediate Joiners

What success looks like in 12 months

• A single, risk-ranked exposure view across infra, containers, apps and code.
• Known-exploited (KEV) vulnerabilities on internet-facing assets fixed or mitigated within agreed SLAs.
• All internet-facing apps behind WAF policies in prevention mode with tuned rules.
• An AI application security baseline in place and applied to every new AI workload.