Vulnerability Management Analyst

Our client in Ispra, Italy is one of the biggest science hubs in Europe.

It employs approximately 3.000 top-notch researchers, engineers and scientists eager to resolve challenges and provide knowledge in order to support EU policies in a variety of areas from agriculture and food security, to environment and climate change, as well as nuclear safety, security and growth.

At the moment, they are looking for a Vulnerability Management Analyst:

The candidate will be in charge of the IT Vulnerability Management service and have to perform the following tasks:

• Manage and configure JRC Vulnerability management platform (Tenable.SC) in collaboration with JRC central IT team.
• Follow-up of the discovered vulnerabilities/issues and provide report to the impacted stakeholders.
• Analyse and disseminate information received from third-parties related to IT vulnerabilities to JRC IT actors.
• Propose solutions to further improve the vulnerability management service and the automation of the tasks.
• Participate to the extension of the IT Vulnerability Management service to JRC Cloud environments
• Perform Security assessments of Information Systems to verify security controls and identify potential vulnerabilities
• The candidate will be requested to dedicate 80% of his/her time for Vulnerability Management and 20% for Security assessment.

Requirements

• Experience with ISO 27000 family of standards or equivalent security standards implementation. Knowledge of ITSRM2 is a plus.
• Excellent knowledge of application security.
• Experience in the security aspect of software development (i.e.: authentication with open id connect SAML or CAS, secure rest or web services, encryption with PKI, authorisation, secrets management).
• Experience with secure IT development patterns.
• Experience in the security domain
• Understanding of risk assessments
• Experience in penetration testing and ethical hacking (i.e.: usage of tools like Metasploit, Burpsuite or equivalent).
• Experience with security test tools (i.e.: Fortify or equivalent) and web site vulnerability scans.
• Good understanding of the 3rd party dependency security (libraries, container and VM images).
• Knowledge of OWASP.
• Knowledge of Agile methodology.
• Good knowledge of English

Mandatory certification (one of):

• Certified Information Systems Security Professional (CISSP)
• Certified Information Security Manager (CISM)
• Certified Ethical Hacker (CEH)
• Offensive Security Certified Professional (OSCP) or equivalent