Vulnerability_CYBERSEC_Associate Consultant

Mandatory skills* - Vulnerability Monitoring & Remediation
•  Continuously track vulnerabilities (CVEs) across endpoints and prioritize remediation efforts.
•  Handle:
   - Multiple vulnerabilities on single hosts
   - Exception management for non-remediable vulnerabilities
   - Suppression of inactive/quarantined/retired assets
•  Raise and manage tickets, incidents, and change requests related to vulnerability remediation

Vulnerability Analysis

• Identify top vulnerable software and exposure trends across workstation fleet
• Correlate vulnerabilities with installed applications, patch status
• Track remediation progress to closure and validate fixes using MDE
• Perform root cause analysis for recurring vulnerabilities and missed patching cycles

Remediation of Application Software specific vulnerabilities
•  Coordinate application upgrades and deployments through structured change management processes.
•  Oversee patching and vulnerability remediation for enterprise applications for ex (not limited to) - Microsoft Office, Python, QGIS, Miniconda, Java (JRE/JDK), Adobe Acrobat, Notepad++, NodeJS, Browsers (Chrome, Edge, Firefox) etc.
•  Work with packaging teams to:
   - Raise deployment requests
   - Validate packaging and testing
•  Monitor installation success via endpoint detection tools (e.g., MDE) and track reduction of vulnerable versions

Patch Compliance Monitoring
•  Monitor Windows patching cycles (QA, Pilot, Production) across laptops, VDIs, cloud systems, and executive machines.
•  Track patch compliance metrics, coordinate with remediation teams for improvements or issues.

Stakeholder Coordination
•  Collaborate with:
   - Desktop/Workplace Computing team
   - End users and application owners
•  Conduct regular follow-ups for remediation activities and ensure closure of pending vulnerabilities.
•  Drive communication with users for software upgrades, uninstallations, and compliance actions.

Reporting Activities and their frequency
•  Daily: Vulnerability monitoring, suppression handling, browser CVE tracking, status reporting
•  Weekly: Patch compliance reporting, remediation follow-ups, WSR
•  Monthly: Consolidated reporting and dashboard preparation
•  Ad-hoc: Ticket handling, exception management, user coordination