Cyber Security Analyst - Vulnerability Management

About the role

The Senior Vulnerability Management Analyst owns the technical reliability and continuous improvement of the organization's vulnerability and exposure management capabilities across infrastructure, applications and cloud environments. The role ensures accurate visibility, high-fidelity data and integrated tooling to support risk-based decisions and effective remediation. It is open to candidates based in Sao Paulo or Bogota, on a hybrid basis (4 days in the office, 1 day remote).

Key responsibilities

• Analyze vulnerability and exposure data across infrastructure, endpoints, applications, cloud and externally exposed assets to identify weaknesses, assess impact and set remediation priority.
• Correlate findings with asset criticality, threat intelligence, exploitability, CVSS, EPSS, CISA KEV and other context to prioritize risks.
• Coordinate with infrastructure, cloud, application and network teams to share findings, guide remediation and track progress.
• Investigate significant findings, validate evidence, recommend mitigations and support root cause analysis.
• Monitor posture and remediation performance, and produce reports, dashboards and presentations for technical and non-technical stakeholders.
• Support intake, prioritization, remediation tracking, exception management, audit requests, Patch Tuesday activities and exposure management.
• Partner with Threat Intelligence, Security Operations and other security teams on emerging vulnerabilities and active exploitation.

Required profile

• 4-6+ years of cybersecurity or IT experience, including vulnerability management, analysis, security operations or infrastructure security.
• Bachelor's or Master's degree in Information Security, Cybersecurity, IT, Computer Science or a related field; equivalent professional experience may be considered.
• Preferred: relevant cybersecurity certifications such as CompTIA Security+, CySA+, SANS/GIAC, Certified Vulnerability Assessor, or vulnerability management training.

Required skills

• Vulnerability management platforms: Rapid7 InsightVM, Microsoft Defender Vulnerability Management, Tenable, Qualys, Armis VIPR, Axonius, Armis Centrix, CTEM tools.
• Ticketing and integration tools: ServiceNow, Jira.
• Cloud: AWS, Azure, GCP.
• Risk concepts: CVSS, EPSS, CISA KEV, asset criticality, external exposure, compensating controls.
• Preferred: exposure management, external attack surface management, CTEM, asset intelligence, and familiarity with CIS Controls, NIST CSF, PCI DSS, ISO 27001, SOX, FINRA.

What we offer

• Medical and life insurance.
• Public transportation support.
• Meal and food allowances.