Senior Vulnerability Management Engineer - Cebu

Senior Vulnerability Management Engineer | Cyber Security

At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture, and technology to become the best version of yourself. We’re counting on your unique voice and perspective to help EY become even better. Join us in building an exceptional experience for yourself and a better working world for all.

The Opportunity

As a Senior Vulnerability Management Engineer within EY Global Delivery Services (GDS) Cybersecurity, you will support client engagements focused on enterprise vulnerability management, vulnerability assessment, security testing, and remediation.

You will work with cybersecurity teams and client stakeholders to identify, assess, prioritize, and address vulnerabilities across infrastructure, cloud environments, databases, web applications, and other enterprise technologies.

Your Key Responsibilities

• Support and manage enterprise Vulnerability Management programs using tools such as Qualys, Rapid7 Nexpose/InsightVM, Tenable, or similar platforms.

• Perform vulnerability assessments across infrastructure, cloud-hosted systems, databases, web services, and applications.

• Manage vulnerability exception and exemption processes and support risk-based remediation decisions.

• Deploy, configure, operate, and optimize vulnerability management tools.

• Analyze vulnerability findings, identify root causes, and provide actionable remediation recommendations.

• Identify security weaknesses and assess their potential impact and exploitability.

• Provide technical guidance to junior team members on vulnerability management and risk management practices.

• Research emerging vulnerabilities, exploits, attack vectors, and developments in the vulnerability management lifecycle.

• Support security assessments involving operating systems, networks, web applications, and cloud environments.

• Drive operational efficiency through Python/PowerShell scripting, automation, reporting, and standardization.

• Collaborate with client stakeholders and cybersecurity teams to communicate risks, remediation priorities, and program improvements.

• Contribute to knowledge-sharing initiatives and cybersecurity thought leadership.

Skills and Attributes for Success

• Strong hands-on experience in Vulnerability Management and Vulnerability Assessment.

• Hands-on experience with Qualys, Nexpose/InsightVM, Tenable, or similar vulnerability management platforms.

• Good knowledge of Windows, Linux, UNIX, and other major operating systems.

• Strong understanding of TCP/IP, network security, and common attack vectors.

• Familiarity with OWASP Top 10, web application vulnerabilities, and cloud security concepts.

• Scripting or programming experience using Python and/or PowerShell.

• Experience automating security processes and working with Python libraries such as Pandas, NumPy, netaddr, ipaddress, lxml, and Qualys API libraries.

• Exposure to data visualization and analytics tools such as Power BI or Tableau.

• Strong analytical, problem-solving, communication, and stakeholder management skills.

To Qualify for the Role

• Bachelor’s or postgraduate degree in Computer Science, Information Systems, Engineering, Business, or a related field.

• At least 3 years of relevant cybersecurity experience, particularly in vulnerability management, vulnerability assessment, and/or penetration testing.

• Hands-on experience with enterprise vulnerability management tools.

• Relevant certification such as CEH, Qualys certification, or CISM.

• Willingness to work in shifts as required.

Ideally, You’ll Also Have

• Experience supporting or leading enterprise-scale vulnerability management programs.

• Penetration testing exposure across networks, web applications, and infrastructure.

• Project management experience.

• Security automation and reporting experience.

What We Look For

We’re looking for someone with strong hands-on vulnerability management expertise who can go beyond simply running scans. The ideal candidate can analyze findings, assess risk and exploitability, identify root causes, recommend remediation, automate repetitive processes, and work closely with stakeholders to improve the overall vulnerability management program.