About the role
The candidate will have responsibilities across the following functions:
Vulnerability Management:
- Own the end-to-end vulnerability lifecycle for a given Business Unit consisting of multiple enterprise-level products. (SaaS and on-prem).
- Triage, track, correlate, and remediate vulnerabilities from tools like Black Duck, Prisma Cloud, Qualys, JFrog Xray, etc.
- Understanding how these tools work and mapping in a common tool.
- Co-ordinate with business security leads to plan patching strategies and risk mitigation.
Security Automation:
- Integrate security scanning tools into common tools.
- In progress and SLA tracking for all the vulnerabilities and work closely with respective business units.
- Develop dashboards and reports for compliance and leadership visibility.
- Write high-level designs to automate some of the manual work.
Collaboration and Governance:
- Work cross-functionally with product teams and stakeholders.
- Contribute to security policies, standards, and best practices.
- Participate in incident response and post-mortem analysis.
Education and Awareness:
- Publish security advisories on high-priority vulnerabilities (CVEs).
- Help junior team members with security aspects.
- Kubernetes, container build pipeline, and repository platform knowledge is a plus.
- Familiarity with vulnerability scoring models like CVSS, EPSS, and BDSA.
Key Technologies:
- Security Tools: Black Duck, Prisma Cloud, Qualys, Snyk, Coverity, SonarQube, Burp Suite.
- DevOps Stack: Jenkins, Kubernetes, Helm, Docker.
- Programming: Python, Shell, YAML, JSON (Good to have).
- Cloud Platforms: AWS, GCP (Understanding the basics of the cloud).