Vulnerability Management Expert
Summary
A security specialist who monitors, triages, and remediates vulnerabilities across third-party dependencies, containers, and CI/CD pipelines. Day to day they analyze SAST/DAST/SCA findings (SonarQube, Checkmarx, OWASP ZAP, Dependabot), automate remediation with Python/Bash in OpenShift environments, document compliance evidence in Jira, and report risk trends to security leadership.
Regularly monitor, triage, and prioritize vulnerabilities in third-party dependencies, libraries, and frameworks.
Analyze security findings from SAST, DAST, and SCA tools (such as SonarQube, Checkmarx, OWASP ZAP, and Dependabot).
Implement and automate processes for dependency updates, vulnerability detection, and remediation within CI/CD pipelines and container environments (like OpenShift).
Document vulnerability assessments, remediation activities, and compliance evidence using tools like Jira and vulnerability management platforms.
Develop and enforce secure coding guidelines, dependency management standards, and best practices.
Report on vulnerability status, remediation progress, and risk trends to stakeholders and security leadership.
Support incident response related to critical vulnerabilities, including zero-day exploits and high-severity CVEs.
Ensure adherence to internal policies and external regulations (such as ISO 27001, NIST, GDPR, and SOC 2).
Familiarity with cloud security principles (AWS, Azure, GCP) and container security practices.
Professional certifications such as CISSP, OSCP, CEH, or CCSP.
Experience with vulnerability management platforms (Tenable, Qualys, Rapid7) and compliance standards.
Experience: Minimum of 3 years of expertise in software security, vulnerability management, or related fields.
Tools & Technologies:
Vulnerability detection and management tools (SAST, DAST, SCA such as SonarQube, Checkmarx, OWASP ZAP, and Dependabot).
Dependency management across multiple ecosystems (npm, Maven, pip, NuGet, or Go modules).
Container orchestration and security (OpenShift and Docker).
Version control systems (Git, GitHub) and issue tracking tools (Jira).
Skills & Knowledge:
Proficiency in scripting and automation (Python, Bash) for integrating security processes into CI/CD workflows.
Deep understanding of vulnerabilities (OWASP Top 10, CWE) and CVSS scoring methodology.
Experience implementing security best practices within DevOps pipelines and cloud environments.
Strong analytical and problem-solving skills.
Familiarity with cloud security principles (AWS, Azure, GCP) and container security practices.
Professional certifications such as CISSP, OSCP, CEH, or CCSP.
Experience with vulnerability management platforms (Tenable, Qualys, Rapid7) and compliance standards.