Vulnerability management Consultant

Must Have Technical/Functional Skills
Strong understanding of:
o CVSS Framework
o CIS Benchmarks
o NIST Cybersecurity Framework
o MITRE Telecommunication&CK
o Common vulnerability exploitation techniques

Roles & Responsibilities
Manage end-to-end Vulnerability Management lifecycle including discovery, assessment, prioritization, remediation tracking, and reporting.
Perform vulnerability assessments across servers, endpoints, network devices, databases, cloud platforms, and applications.
Analyze vulnerability scan results and recommend remediation strategies based on risk and business impact.
Collaborate with infrastructure, application, cloud, and operations teams to drive remediation activities.
Establish and monitor vulnerability remediation SLAs and compliance metrics.
Conduct risk-based prioritization leveraging CVSS scores, threat intelligence, exploitability, asset criticality, and business context.
Develop executive dashboards, operational reports, and metrics for leadership review.
Manage vulnerability exceptions and risk acceptance processes.
Support audit, compliance, and regulatory requirements related to security vulnerabilities.
Perform trend analysis and identify recurring security weaknesses.
Integrate vulnerability management processes with SIEM, ITSM, CMDB, asset management, and threat intelligence platforms. Drive continuous improvement initiatives for vulnerability management programs.

Generic Managerial Skills, If any
Vulnerability assessment and remediation reports.
Executive risk dashboards and metrics.
SLA compliance tracking and remediation governance.
Monthly and quarterly risk posture reviews.
Continuous improvement recommendations for vulnerability management operations.

Nice-to-Have Skills
Exposure Management
Attack Surface Management (ASM)
5+ years of experience in Vulnerability Management, Cybersecurity Operations, or Security Engineering.

Hands-on experience with tools such as:
o Tenable Security Center / Tenable.io
o Qualys VMDR
o Rapid7 InsightVM
o Microsoft Defender Vulnerability Management
o ServiceNow Vulnerability Response