Vulnerability Management Associate

Role Summary

The role of Vulnerability Management is to triage vulnerabilities by relevance and criticality to the organisation. Vulnerability Management then identify mitigations for those vulnerabilities and advise on implementing them.

Role Expectations

Typically, this role level may include the following responsibilities:

• Analyse complex information systems to understand the associated Cyber Security risks, audit requirements, and data value
• Support the creation and implementation of vulnerability assessments of enterprise assets to a predefined scope and schedule using predetermined templates and test scripts, including but not limited to:
  – application vulnerability assessments
  – infrastructure vulnerability assessments
• Assist in the prioritisation of those vulnerabilities through a risk-based approach
• Triage and prioritise vulnerabilities, implement mitigating measures, and support in the life cycle of vulnerability management, providing standardised advice on ways to improve control mechanisms and mitigate risk
• Collaborate with stakeholders to manage vulnerabilities and undertake remediation activities
• Communicate common mitigation strategies such as patching and basic configuration change (system hardening)
• Understand how local protective security measures can be applied to reduce vulnerability exposure
• Demonstrate knowledge of common approaches and tooling to perform vulnerability assessment and to validate system configuration
• Perform vulnerability assessments of enterprise assets with limited supervision to a predefined scope and schedule using predetermined templates and test scripts
• Develop and implement schedules for performing vulnerability assessments to meet organisational objectives and compliance requirements

Entry route and progression

Internal

Suitable for an individual from the Government Security Profession, Digital, Data and Technology Profession, or Analytics Profession.

External

Suitable for an individual who has worked in penetration testing, application security and development security operations in the private sector.