Vulnerability Management & Control Efficacy Analyst

Quantify security effectiveness by moving from qualitative assessments to data-driven risk modeling. You will bridge the gap between technical vulnerability data and financial risk, ensuring that control failures and security gaps are measured, prioritized, and remediated based on their actual business impact.

Responsibilities

Quantitative Risk Modeling: Run Monte Carlo simulations to calculate Annual Loss Expectancy (ALE) and use Bayesian inference to update risk probabilities based on internal vulnerability telemetry and external evidence; Vulnerability Life Cycle & Analysis: Collate and track vulnerabilities in a centralized platform, mapping them directly to the corporate security risk register across all divisions; Perform multi-dimensional analysis to determine prioritization scores, determining which vulnerabilities require immediate correction based on Threat Intelligence, vulnerability intelligence, and aggregated incident response data; Streamline and optimize various vulnerability management processes to reduce Mean Time to Remediate (MTTR); Governance & Escalation: Support the Security Governance Department with remediation follow-up; continuously monitor risk posture and escalate major risks that exceed the company's risk appetite; Control Efficacy: Use Linear Regression to correlate vulnerability metrics (e.g., patch latency) with business downtime and financial loss; AI Automation: Apply AI Prompt Engineering to automate KRI/KPI generation using Python/SQL and to interpret complex statistical outputs for executive reporting

Requirements

4+ years in Cybersecurity, Vulnerability Management, or Quantitative Risk; Understanding of probability distributions (Lognormal, Poisson, Beta) and statistical significance (p-values, R^2); Proficiency in Python or R for data modeling and SQL for querying security telemetry; Deep understanding of the vulnerability management life cycle, prioritization frameworks (CVSS, EPSS), and technical control failure modes; Awareness of potential compliance risks and commitment to act with integrity

Nice to have

Proficiency with FAIR (Factor Analysis of Information Risk); Experience managing security controls in AWS, Azure, or GCP; Certifications: CRISC, CISM, or CISSP

Benefits

Flexible working arrangements; inclusive working environment; workforce diversity