Vulnerability Management Consultant

Codetech•Erlanger, KY

18h•Onsite

About The Position

The Vulnerability Management Consultant reviews projects and technical design documents to identify information security risks and recommend suitable controls and mitigations early in the program. The role assesses application, infrastructure, network, cloud, and vendor-related risks against client policies, security standards, and applicable legal and regulatory requirements. It translates technical, legal, and regulatory obligations into security controls and implementation guidance, and supports stakeholders in managing identified and residual risks. The consultant reviews vulnerability assessment and penetration test results, advises on remediation, evaluates supplier control designs, and tracks risks according to Information Risk Management standards. The role works with project managers, business analysts, architecture, and support teams; verifies control effectiveness after implementation; and conducts security governance with client stakeholders. The position is onsite in Erlanger, Kentucky, five days per week.

Requirements

13+ years of experience.
Experience with infrastructure vulnerability management using Qualys, Rapid7, Tenable.io, and Tenable Nessus, SC, and CS.
Experience with vulnerability triage, remediation advisory, ServiceNow, ITSM, and CMDB.
Project coordination skills.
Understanding of technology landscapes, including applications, infrastructure, and cloud.
Understanding of security standards and practices including ISO 27001, SOX ITGC, SOC 1 or SOC 2, DevSecOps, OWASP Top 10, ISO 22301, and ISO 27005.
Knowledge of security risk assessment and management, control design and testing, data security, security policy review, business continuity, cloud security, network security, identity and access management, privacy requirements, and information security baselines.
Understanding of secure application development and support, network security, data security practices, endpoint security, identity and access management, business continuity planning, and disaster recovery.
Project, stakeholder, governance, and management reporting skills.
Very good communication skills.
Ability to work onsite in Erlanger, Kentucky, five days per week.

Nice To Haves

Education background in BTech, CA, MBA, MS Information Security, or MTech.
Industry certifications such as ISO 27001 Lead Auditor or Lead Implementer, CISA, CRISC, CISM, or CISSP.
Experience with Agile project delivery and cloud security controls.

Responsibilities

Review projects and technical design documents for information security risks and advise on controls and mitigations early in the program.
Assess and classify potential business and infrastructure information risks.
Review information security risks in vendor offerings and new or existing SaaS, PaaS, and IaaS services, including integration with the client environment.
Conduct risk assessments of applications, networks, and systems against client policies, applicable standards, and legal and regulatory requirements.
Identify risks in client projects and recommend remediation.
Translate technical, legal, and regulatory compliance obligations into security controls and provide stakeholders with Information Risk Management requirements and implementation methodologies.
Identify or design controls based on risk assessment outcomes, remediation, and residual risk; review that application and infrastructure controls are designed effectively.
Review vulnerability assessment and penetration test scan results and recommend risks for remediation.
Review and approve supplier control designs and technical specifications against client security control requirements.
Document, classify, and track risks with appropriate actions according to Information Risk Management standards.
Coordinate with project managers, business analysts, architecture, and support teams to ensure client Information Risk Management standards are followed.
Test control effectiveness after controls and technologies are implemented or deployed.
Conduct security governance with client stakeholders.