Vulnerability Management Security Sr. Analyst

What success looks like in this role:

Vulnerability Assessment & Scanning

• Plan, schedule, and execute vulnerability scans across network, endpoint, server, and cloud environments using tools such as Nessus, Qualys, Rapid7 InsightVM, or Microsoft Defender Vulnerability Management.
• Perform authenticated and unauthenticated scans, ensuring coverage across all in-scope assets.
• Conduct ad hoc scans following remediation activities to validate closure of identified vulnerabilities.
• Maintain and continuously improve scan coverage, ensuring no asset gaps in the vulnerability programme.

Analysis & Risk Prioritisation

• Analyse scan results and assess vulnerabilities based on CVSS scores, exploit availability, asset criticality, and business impact.
• Correlate vulnerability findings with threat intelligence feeds to identify actively exploited vulnerabilities that require expedited remediation.
• Differentiate and prioritise Critical, High, Medium, and Low severity vulnerabilities in line with client SLAs and organisational risk appetite.
• Provide contextual risk analysis beyond automated scoring, considering the environment and compensating controls in place.

Remediation Management & Follow-up

• Assign remediation tasks to relevant resolver teams and track progress through to closure.
• Conduct regular follow-up with resolver teams to ensure patch deployment, configuration changes, or compensating controls are applied within agreed timelines.
• Escalate overdue or high-risk items to management and client stakeholders as appropriate.
• Validate remediation completeness through rescan confirmation and update records accordingly.

Reporting & Governance

• Prepare and deliver monthly, weekly, and ad hoc vulnerability management reports for client and internal stakeholders, including trend analysis, SLA performance, and risk posture summaries.
• Maintain accurate and up-to-date vulnerability records across ticketing and vulnerability management platforms.
• Support governance meetings, monthly business reviews, and audit activities with relevant vulnerability data and evidence.
• Track and report on KPIs such as mean time to remediate (MTTR), vulnerability age, and scan coverage.

Client & Stakeholder Engagement

• Act as a point of contact for client queries related to vulnerability findings, remediation status, and risk assessment.
• Provide guidance and recommendations to resolver teams and clients on remediation approaches, patch management, and risk acceptance.
• Participate in client calls and governance forums, presenting vulnerability posture and remediation progress clearly and concisely.

Process Improvement & Documentation

• Maintain and continuously improve vulnerability management SOPs, playbooks, and process documentation.
• Identify opportunities to automate or streamline scanning, reporting, and remediation tracking workflows.
• Stay current with emerging vulnerabilities, CVEs, threat actor activity, and vendor advisories, and communicate relevant intelligence to the team and stakeholders.
• Support tool evaluations, onboarding of new scan targets, and integration of new clients or entities into the vulnerability programme.

You will be successful in this role if you have:

• 4–6 years of experience in cybersecurity with at least 2–3 years focused on vulnerability management.
• Hands-on experience with vulnerability scanning tools — Nessus Professional, Qualys, Rapid7 InsightVM, Defender or equivalent.
• Working knowledge of network protocols, operating systems (Windows, Linux), and cloud platforms (Azure, AWS, GCP).
• Experience with ITSM and ticketing platforms such as ServiceNow for remediation tracking.
• Strong analytical and report-writing skills with the ability to communicate technical findings to non-technical audiences.
• Experience working in a managed security services or client-facing environment is preferred.

Unisys is proud to be an equal opportunity employer that considers all qualified applicants without regard to age, blood type, caste, citizenship, color, disability, family medical history, family status, ethnicity, gender, gender expression, gender identity, genetic information, marital status, national origin, parental status, pregnancy, race, religion, sex, sexual orientation, transgender status, veteran status or any other category protected by law.

Local employment practices and rights may vary by jurisdiction and are subject to applicable local laws. This commitment includes our efforts to provide for all those who seek to express interest in employment the opportunity to participate without barriers.

If you are a US job seeker unable to review the job opportunities herein, or cannot otherwise complete your expression of interest, without additional assistance and would like to discuss a request for reasonable accommodation, please contact our Global Recruiting organization at [email protected]. US job seekers can find more information about Unisys’ EEO commitment here.