Cybersecurity Vulnerability Analyst - Level Standard (60% remote, Warsaw) – EU Public Orgs

The White Team•Capon Bridge, WV

4h•Hybrid

About The Position

The Cybersecurity Vulnerability Analyst works at Frontex Headquarters in Warsaw, with 40% onsite and 60% remote service provision. The mission duration is 46 months. EU Personnel Security Clearance at Tier CONFIDENTIEL UE/EU CONFIDENTIAL is strictly required from the first day of the assignment. Travel is not foreseen. The role focuses on receiving and analyzing hardware and software vulnerability reports, assessing their nature and impact, and developing strategies to detect, remediate, or mitigate vulnerabilities. The analyst proactively manages vulnerabilities through assessments, penetration tests, vulnerability scans, and reviews of systems’ and services’ compliance with technical security baselines. The role also manages responses to disclosed vulnerabilities without available countermeasures, coordinating as needed with vendors, CSIRTs, technical experts, Agency members, and vulnerability reporters. The analyst evaluates security audits and test results, prioritizes findings, and plans and implements remediation controls. Responsibilities also include forensic analysis in response to security incidents, assessing security controls for new applications, vulnerability monitoring and triage, validating and reproducing suspected vulnerabilities, reviewing source code, communicating findings and remediation guidance across the Agency, and verifying that response strategies have been implemented successfully. The position produces vulnerability, penetration-test, compliance, KPI dashboard, and activity reports, including recommendations and remediation follow-up. The analyst also participates in defining security baselines and reports service SLA and quality to management.

Requirements

At least 5 years of relevant IT experience, including 3 years in relevant roles.
At least a Level 6 education qualification (Bachelor’s degree).
Minimum English language proficiency of B2.
EU Personnel Security Clearance at Tier CONFIDENTIEL UE/EU CONFIDENTIAL from the first day of the assignment.
At least two of the listed technical certifications, or internationally recognized equivalent certifications accepted by the Contracting Authority. Listed examples include GCED, GPPA, GCWN, GCUX, GCCC, SSCP, GPEN, GXPN, GMOB, NDS, ECSA, GSNA, GSEC, and SCPO.
Knowledge of the systems development life cycle, operating-system security, computer-network security, security controls, offensive and defensive security practices, and secure coding practices.
Hands-on ICT experience in a Cybersecurity Vulnerability Analyst role.
Knowledge of system vulnerabilities, threats and exploit mechanisms, penetration testing, remediation techniques, and risk analysis methodologies.
Knowledge of OWASP standards.
Practical experience designing and performing security tests.
Practical knowledge of the Tenable vulnerability management suite, NMAP, Wireshark, and BurpSuite.
Analytical ability, attention to detail, adaptability, and problem-solving skills.
Ability to document, report, present, and communicate with various stakeholders.
Ability to develop code, scripts, and programs; identify and exploit vulnerabilities; conduct ethical hacking; and use penetration-testing tools effectively.
Ability to conduct technical analysis and reporting, decompose and analyze systems to identify weaknesses and ineffective controls, and identify and troubleshoot cybersecurity issues.
Ability to review code, assess its security, integrate cybersecurity solutions into organizational infrastructure, configure solutions according to security policy, and assess solution security and performance.
Ability to develop and test secure code and scripts.
Experience analyzing vulnerabilities and assessing risk in the context of a vulnerability and its environment.
Experience coordinating and executing penetration tests and familiarity with common web application exploits.
Proficiency in writing vulnerability and patch-management reports.
Experience reviewing current security controls and proposing improvements.
Experience writing security procedures and policies emphasizing information protection and data privacy.
Experience administering security solutions, including vulnerability platforms, WAF, and EDR.

Nice To Haves

Innovative approach to new technologies.
CISSP certification; described as non-mandatory and accepted as one of the two required certificates.

Responsibilities

Receive information and reports about hardware and software vulnerabilities; analyze their nature, mechanics, and effects; and develop strategies to detect, repair, or mitigate them.
Proactively manage vulnerabilities through vulnerability assessments, penetration tests, and reviews of technical security compliance against baseline configurations.
Manage responses to disclosed vulnerabilities for which no countermeasure is available, coordinating with vendors, CSIRTs, technical experts, Agency members, and vulnerability reporters as needed.
Evaluate security audit and test results, prioritize findings, and plan and implement remediation controls.
Provide forensic analysis in response to information security incidents.
Assess security controls of new applications to establish compliance levels and appropriate configurations.
Perform vulnerability monitoring and process incoming vulnerability warnings, alerts, and reports.
Oversee management of known vulnerabilities through established processes and procedures, including verification, exposure, and impact-based triage.
Analyze hardware and software vulnerabilities and validate suspected vulnerabilities by locating them and determining how they can be exploited.
Review source code, use a debugger to locate vulnerabilities, or reproduce problems on a test system.
Notify relevant Agency parties about vulnerabilities and share information on how to fix or mitigate them.
Verify that vulnerability response strategies have been successfully implemented.
Perform regular vulnerability scans of systems and applications, report findings and recommendations, and follow up on remediation.
Provide regular KPI-based reports and dashboards to monitor security improvements.
Perform penetration tests and report recommendations for improvement.
Review technical security compliance against defined security baselines, report non-compliance, and follow up on remediation.
Participate in defining security baselines.
Provide activity reports to management demonstrating service SLA and quality.