vulnerability assessment analyst

4P Consulting Inc.

<div><div>Vulnerability Assessment Analyst IV &ndash; Container Security &amp; Exposure Management
<p><b>Location: </b>Birmingham, AL or Atlanta, GA
<br>
<b>Client: </b>Southern Company Services
<br>
<b>Contract Duration: </b>15 Months
<br>
<b>Work Schedule: </b>Hybrid &ndash; 4 days onsite
<br>
<b>Experience: </b>10+ Years
</p><h2 class="jobSectionHeader"><b>Job Summary
</b></h2><p>We are seeking an experienced <b>Vulnerability Assessment Analyst IV </b>to support container security and exposure management within a cybersecurity organization. This role will focus on identifying, validating, and assessing security vulnerabilities across IT/OT systems, cloud-native platforms, Kubernetes, OpenShift, Docker, container images, clusters, pipelines, and supporting infrastructure.
</p><p>The ideal candidate will have strong hands-on experience with vulnerability assessment, container security, DevSecOps, exposure management, attack path analysis, scripting, and risk reporting.
</p><h2 class="jobSectionHeader"><b>Key Responsibilities
</b></h2><ul><li>Identify and assess security vulnerabilities across IT and OT systems.
</li><li>Perform vulnerability scans and analyze exposures in web applications, networks, systems, embedded devices, firmware, and containerized environments.
</li><li>Evaluate container security risks across Kubernetes, OpenShift, Docker, AKS, EKS, GKE, and similar platforms.
</li><li>Assess container images, base images, dependencies, Kubernetes manifests, Helm charts, runtimes, RBAC, network policies, secrets handling, and cluster configurations.
</li><li>Validate exposure paths and determine real-world exploit potential.
</li><li>Conduct attack path mapping and prioritize high-risk vulnerabilities.
</li><li>Support exposure management operations, including data review, reporting, trend analysis, remediation tracking, and escalation.
</li><li>Partner with platform, infrastructure, application, DevOps, and security teams to recommend practical mitigation strategies.
</li><li>Monitor emerging threats, zero-days, CVEs, and exploitation methods.
</li><li>Translate technical findings into clear business risk summaries for stakeholders and leadership.
</li></ul><h2 class="jobSectionHeader"><b>Required Qualifications
</b></h2><ul><li>10+ years of experience in cybersecurity, vulnerability assessment, exposure management, DevSecOps, infrastructure security, or related roles.
</li><li>Bachelor&rsquo;s degree in Computer Science, Cybersecurity, or equivalent experience.
</li><li>Strong experience with Kubernetes, OpenShift, Docker, AKS, EKS, GKE, or similar container platforms.
</li><li>Ability to assess vulnerabilities in container images, dependencies, manifests, Helm charts, runtimes, and cluster configurations.
</li><li>Knowledge of container security controls such as image scanning, least privilege, non-root containers, secrets handling, RBAC, pod security standards, network policies, and runtime monitoring.
</li><li>Experience with vulnerability management, attack surface management, cloud security posture management, and exposure management.
</li><li>Proficiency with scripting languages such as Python, PowerShell, or Bash.
</li><li>Familiarity with OWASP methodologies and common application/system vulnerabilities.
</li><li>Experience with SIEM platforms for detection validation and log analysis.
</li><li>Strong analytical, troubleshooting, communication, and documentation skills.
</li><li>Must pass NERC CIP and Insider Threat Protection background checks.
</li></ul><h2 class="jobSectionHeader"><b>Preferred Qualifications
</b></h2><ul><li>Experience in DevSecOps, application security, offensive security, penetration testing, adversarial threat simulation, or container platform engineering.
</li><li>Certifications such as CKS, CKAD, CKA, OSCP, CEH, GSEC, CISSP, or CISA.
</li><li>Experience supporting IT and OT security environments.
</li><li>Experience working with cloud-native enterprise systems and CI/CD pipelines.
</li></ul><h2 class="jobSectionHeader"><b>Key Skills
</b></h2><p>Vulnerability Assessment, Container Security, Exposure Management, Kubernetes, OpenShift, Docker, DevSecOps, IT/OT Security, Cloud Security, Attack Path Mapping, Vulnerability Management, SIEM, OWASP, RBAC, Image Scanning, Runtime Monitoring, Python, PowerShell, Bash, CI/CD Security, Risk Reporting.</p></div></div>

Vulnerability Assessment Analyst IV 4P/715

Confidential Government

<div>
 <p>
  We are seeking a Vulnerability Management Consultant to manage the end-to-end lifecycle of discovering and remediating technical security flaws.
 </p>
 <p>
  <br/>
 </p>
 <p>
  Role Overview:
 </p>
 <p>
  A methodical leadership role focused on attack surface reduction across a diverse enterprise landscape.
 </p>
 <p>
  Core Purpose: To drastically reduce the organizational attack surface by ensuring critical flaws are identified and closed efficiently.
 </p>
 <p>
  <br/>
 </p>
 <p>
  Key Responsibilities:
 </p>
 <ul>
  <li>
   Oversee global vulnerability scanning across infrastructure, applications, and hybrid cloud assets.
  </li>
  <li>
   Implement a risk-based prioritization model that accounts for threat intelligence and business context.
  </li>
  <li>
   Coordinate patching and remediation efforts with cross-functional IT operations teams.
  </li>
 </ul>
 <p>
  <br/>
 </p>
 <p>
  Qualifications:
 </p>
 <ul>
  <li>
   Bachelor's degree in Information Technology or Computer Science.
  </li>
  <li>
   5+ years of experience in Vulnerability Management or Systems Administration.
  </li>
  <li>
   Certifications: GEVA or CISSP.
  </li>
  <li>
   Competencies: Expert proficiency in Qualys, Tenable, or Rapid7 and strong project management skills.
  </li>
 </ul>
 <p>
 </p>
</div>


Vulnerability Management Consultant

Mobius LLC

<div><div><p>Mobius is an award winning, Small Business Administration (SBA) certified Historically Underutilized Business Zone (HUBZone) company and certified Woman-Owned Small Business (WOSB) providing engineering, analytical, and programmatic expertise to the Federal Government and commercial customers. Our mission is to provide innovative advanced technology solutions to customers facing issues of national and global significance. We strive to be admired for excellent people, fair and honest partnership, innovative problem solving, and exceptional performance.</p></div><div><p>
Come join our team! Mobius is seeking an Insider Threat UAM Analyst. In this role you will support the analysis, development, and implementation of UAM policies, procedures, standards, and methods for identifying, preventing, and protecting information, personnel, facilities, operations, or material where the loss could pose a direct threat to national security. Will serve as a member of a government-led Insider Threat &ndash; UAM Analysis Team, with a focus on Information Assurance (IA)/Computer Network Defense (CND) and Security. In this position you will apply your broad knowledge of Cybersecurity, counterintelligence, security, UAM, cyber threat analysis, incident response, intrusion detection,</p>
<p><i>
Clearance</i></p>
<ul>
<li>Active TS/SCI. The highest level of security required for this requirement is TOP SECRET/SCI and SI/TK/G/HCS//as necessary to work within a SCIF. Access to Joint World-Wide Intelligence Communication System (JWICS) is required. As a Contractor for the Navy Insider Threat Program, all Contractors are subject to Navy Insider Threat Random Polygraphs.</li></ul></div><p></p><div><div><p><br>
Pay Range</p><p>
$100,000 - $110,000 USD</p></div></div><div><p><b>
Mobius Benefits: </b>Mobius offers a stable work environment, a competitive salary, and a comprehensive benefits package, which includes medical, dental and vision plans, 401k Plan, Flexible Work Schedules, Tuition Reimbursement, Paid Leave and much more.</p>
<p><b><i>
Mobius is committed to hiring and retaining a diverse workforce. We are proud to be an Equal Opportunity Employer/Affirmative Action Employer, making decisions without regard to race, color, religion, creed, sex, sexual orientation, gender identity, marital status, national origin, age, veteran status, disability, or any other protected class.</i></b></p></div></div>

Insider Threat UAM Analyst

Xenon7

<div><p><b>Location:</b> Cairo, Egypt (100% On-Premise)</p><p><b>
Contract Duration:</b> 6 Months (Extendable)</p><p><b>
Employment Type:</b> Contract</p><p></p><p><b>
About us:</b></p><p>
Where elite tech talent meets world-class opportunities!</p><p>
At Xenon7, we work with leading enterprises and innovative startups on exciting, cutting-edge projects that leverage the latest technologies across various domains of IT including Data, Web, Infrastructure, AI, and many others. Our expertise in IT solutions development and on-demand resources allows us to partner with clients on transformative initiatives, driving innovation and business growth. Whether it's empowering global organizations or collaborating with trailblazing startups, we are committed to delivering advanced, impactful solutions that meet today&rsquo;s most complex challenges.</p>
About the Client:<p>
Join one of Egypt&rsquo;s premier financial institutions, renowned for its extensive suite of banking services, including Institutional Banking, Personal Banking, and Islamic Banking. With a global presence through over 50 branches and correspondents, we serve a diverse and dynamic clientele. As we embark on a groundbreaking digital transformation journey, we are committed to leveraging the latest technologies to establish a state-of-the-art data architecture that will redefine our performance and service delivery.</p>
Job Summary:<p>
This role covers highly technical disciplines within InfoSec: security architecture, engineering review, and the maturation of vulnerability and patch management systems. The specialist works closely with internal Security Architecture managers and the Security Operations Center (SOC) team to strengthen the bank's detection and defensive posture, ensure new infrastructure designs are secure by design, and fully operationalize the vulnerability management lifecycle.</p>
Key Responsibilities:<p>
A. Security Architecture &amp; Engineering Assessment</p><ul><li>Review new and changed system designs, network architectures, and digital platform builds from an</li></ul><p>
information security perspective, prior to build or procurement approval.</p><ul><li>Produce Security Architecture Review Reports with risk-rated findings, threat model summaries, and</li></ul><p>
design recommendations aligned to security standards and CBE requirements.</p><ul><li>Assess security of APIs, cloud components, integration layers, and digital banking platforms (mobile,</li></ul><p>
internet banking, payment processing) against OWASP, NIST, and CBE guidelines.</p><ul><li>Maintain an architecture review register tracking all submitted designs, decisions, and open risk items.</li><li>Contribute to the InfoSec reference architecture and security design patterns library.</li></ul><p>
B. Tenable SC &mdash; Vulnerability &amp; Patch Management</p><ul><li>Take ownership of Tenable Security Center (SC) and other vulnerability solutions configuration, scan</li></ul><p>
policy design, and coverage assurance across full asset inventory.</p><ul><li>Design and implement a structured vulnerability management workflow &mdash; scan, triage, risk-rate, assign,</li></ul><p>
track, and verify remediation &mdash; integrated with IT's patch management process.</p><ul><li>Produce weekly and monthly vulnerability dashboards for IT and InfoSec leadership showing patch SLA</li></ul><p>
compliance, critical exposure trends, and remediation velocity.</p><ul><li>Define and enforce scan coverage SLAs: all in-scope assets scanned at appropriate frequency per asset</li></ul><p>
criticality tier.</p><ul><li>Identify and escalate monitoring blind spots &mdash; unscanned, uncredentialed, or unreachable assets &mdash; and</li></ul><p>
drive resolution with IT.</p><ul><li>Enable Tenable SC reporting to feed directly into KRI metrics for board-level visibility on patch SLA</li></ul><p>
breach rate and vulnerability exposure.</p><b><br>
Requirements</b><p></p><ul><li><br>
Minimum 8 years in information security with strong hands-on technical depth across at least two of the</li></ul><p>
three disciplines in this role.</p><ul><li>Proven Tenable SC (or Tenable.io) administration and workflow design experience &mdash; must be able to</li></ul><p>
demonstrate scan configuration, policy tuning, and dashboard creation.</p><ul><li>Experience conducting security architecture reviews for banking or financial sector projects.</li><li>Practical threat hunting experience using SIEM and EDR platforms with documented hunt outputs.</li><li>Familiarity with MITRE ATT&amp;CK framework and its application to threat hunting and detection</li></ul><p>
engineering.</p><p></p><p><b>
Preferred Certifications</b></p><ul><li>Tenable Certified Security Engineer (TCSE) or Tenable.sc Specialist</li><li>GIAC Certified Enterprise Defender (GCED) or GIAC Certified Threat Intelligence Analyst (GCTI)</li><li>CISSP &mdash; Certified Information Systems Security Professional</li><li>SABSA Chartered Security Architect (SCF or SCP)</li></ul><p></p><p><b>
Preferred Experience</b></p><ul><li>Experience in Egyptian banking or financial institution regulated by CBE.</li><li>Hands-on with F5 AWAF, Palo Alto, or equivalent network/application security controls from an</li></ul><p>
assessment perspective.</p><ul><li>Familiarity with NIST CSF 2.0 and CBE Cybersecurity Framework control domains.</li></ul><b><br>
Benefits</b><br>
<ul><li><b>
Attractive, market-leading salary package</b></li><li><b>
Clear career advancement path with professional development opportunities</b></li></ul></div>

Security Architecture, Engineering & Threat Operations Lead - Banking

Concept Plus

<div><p><b>About Concept Plus</b><br>
<br>
Concept Plus is a mission-focused technology solutions provider that transforms IT concepts into impactful solutions for federal agencies. Headquartered in Fairfax, VA, we bring the agility, responsiveness, and customer intimacy of a small business combined with the quality and infrastructure of a larger firm.</p><p></p><p><br>
Recognized as an award-winning Oracle partner, we have delivered innovative solutions across Defense, Intelligence, Civilian, Health IT, and Tribal sectors. Our highly certified experts build systems that drive efficiency, accelerate modernization, and ensure mission outcomes with certainty.</p><p></p><p><br>
We offer competitive pay, comprehensive health, dental, and vision insurance, paid life insurance, paid time off, 11 paid holidays, performance bonuses, tuition reimbursement, unlimited training, and the opportunity to thrive in a collaborative, flexible, and innovative environment.</p><p></p><p><br>
For more information, visit www.conceptplus.com.</p><p></p><p><b><br>
About the role</b></p><p>
Concept Plus is seeking a highly capable, self-driven Cyber Analyst to support a critical software modernization initiative for our client. This position plays a key role in analyzing mission-focused requirements, streamlining processes, and enhancing decision-making for operations.</p><p>
As the strategic link between operational objectives and technology solutions, the Cyber Analyst will translate complex business needs into actionable insights and support the successful execution of priorities while ensuring alignment with client compliance standards.</p><p>
This role operates within a collaborative Agile and DevSecOps framework to ensure secure, timely, and iterative delivery of capabilities. The ideal candidate thrives in a fast-paced, evolving environment and brings a deep understanding of both business processes and technological integration.</p><p></p><p><b><br>
What you'll do</b></p><ul><li>
Lead and maintain the full RMF/ATO lifecycle, managing security authorization packages and updating SSPs, POA&amp;Ms, risk assessments, and continuous monitoring artifacts.</li><li>
Ensure system confidentiality, integrity, and availability through compliance with NIST 800‑53, DoDI 8500.01, DoDI 8510.01, and related DoD cybersecurity policies.</li><li>
Support Agile/DevSecOps deployments, integrating cybersecurity requirements into sprints, CI/CD pipelines, release schedules, and system design reviews.</li><li>
Perform vulnerability scanning, assessment, and remediation&mdash;using Nessus, eMASS, SonarQube, Checkmarx, Trivy, Dependency Track&mdash;and ensure compliance with DISA STIGs.</li><li>
Perform cloud focused vulnerability scanning, assessment, and remediation using Nessus, eMASS, SonarQube, Checkmarx ensuring compliance with cloud security baselines.</li><li>
Provide security engineering support, including secure architecture input, SSO/SSL integration, secure configuration guidance, and API/cloud security reinforcement.</li><li>
Collaborate with technical teams, ISSMs, and AO representatives to support audits, inspections, security reviews, and risk mitigation activities.</li><li>
Track, report, and respond to cybersecurity incidents, ensuring timely coordination and recovery actions.</li><li>
Develop and maintain key cybersecurity documentation, including ISAs, MOAs, SoD matrices, architecture diagrams, and application/database security artifacts.</li><li>
Monitor project progress and deliver clear, actionable cybersecurity reports and risk insights to leadership and government stakeholders.</li><li>
Communicate effectively with internal teams, customers, and stakeholders in a clear, concise, and professional manner.</li></ul><p></p><p><b><br>
Required Qualifications</b></p><ul><li>
US Citizen</li><li>
Ability to obtain and/or maintain a government clearance.</li><li>
Bachelor&rsquo;s Degree in an IT related field</li><li>
CISSP Certification (IAT Level 3 Certification)</li><li>
8+ years of experience as Cyber Analyst</li><li>
5+ years&rsquo; experience with ATO procurement in Cloud Environment</li><li>
5+ years in DoD Environment</li><li>
5+ Years Experience with the Risk Management Framework Process</li><li>
5+ Years Experience operating the Enterprise Mission Assurance Support Service Application (eMASS)</li></ul><p></p><p><b><br>
Preferred Qualifications</b></p><ul><li>
DOD/Government contracting experience, Government IT systems experience.</li><li>
Able to work independently and report to a blended Cyber Team ISSM</li><li>
Good documentation skills</li><li>
Confident communicator with excellent verbal and written skills</li></ul><p></p><p><i><br>
Concept Plus is an Equal Opportunity Employer. As such, we will give your application full consideration without regard to your race, color, religion, sex, age, national origin, disability, veteran status, sexual orientation, gender identity, or any other classification protected by federal, state, or local law.</i></p></div><p></p>

Cyber Analyst

U.S. Financial Technology

<div>OVERVIEW:<div></div><div><b><br>
The Company</b></div><div></div><div><br>
U.S. Financial Technology (U.S. FinTech) is seeking an experienced Lead, Security Engineer Vulnerability and Configuration Management to join our team of talented professionals. This is a full-time remote opportunity.</div><div></div><div><br>
U.S. FinTech built and operates the largest and most advanced mortgage securitization platform in the world, supporting the Uniform Mortgage-Backed Security (UMBS) of Fannie Mae and Freddie Mac.</div><div></div><div><br>
Supporting 70% of the mortgage-backed securities in the market, U.S. FinTech provides best-in-class single-family issuance, bond administration, disclosure, and tax services. We support a broad portfolio of products for our clients with full lifecycle management.</div><div></div><div><br>
Our market-leading, cloud-based, end-to-end platform executes transactions on an extraordinary scale which has bolstered liquidity in the secondary mortgage market, one of the largest and most important financial markets in the world. Our unique approach to securitization combines the best minds in financial services with the know-how, flexibility, and innovation of leading technologists.</div>
RESPONSIBILITIES :<p></p><p><b><br>
Job Information</b></p><div><br>
The Lead Vulnerability and Compliance Analyst main responsibilities would be to act as a Subject Matter Expert for all programs within the VCM space. This would include conducting comprehensive vulnerability assessments using tools such as Wiz and Tenable. Leverage strong analytical and problem-solving skills to identify weaknesses in US FinTech&rsquo;s IT Infrastructure. Communicate findings effectively, via reports/meetings to prioritize vulnerability remediation. Utilize the developed processes to track, prioritize, and ensure remediation of found vulnerability and compliance issues. Continuous monitor US FinTech infrastructure for Vulnerability and Compliance related issues. Make Improvements to monitors, scans, dashboards, and reporting. Ability to work independently and in a team environment, collaborate effectively with other InfoSec Teams and IT Infrastructure teams. Eager to learn and adapt to emerging cloud technologies and tools in a fast-paced environment.</div><p><b><br>
Key Job Functions</b></p><ul><li>
Vulnerability Assessment</li><li>
Act as a Subject Matter Expert for the VCM program, processes, and tooling.</li><li>
Configure, tune, and maintain vulnerability management tools</li><li>
Work with Security Architecture on new build outs, new business, new technologies, new environments to ensure coverage of VCM programs, processes, and tooling.</li><li>
Build out new Security baselines for CIS, DISA STIG, and custom baselines.</li><li>
Correlate Vulnerabilities with threat intelligence to assess exploitability and risk. Work with Cyber Security Operations Center to ensure mitigations are in place while vulnerabilities are being remediated</li><li>
Provide detailed risk assessments for discovered vulnerabilities.</li><li>
Enforce remediation timelines in accordance with Standard Operating Procedures.<ul><li>
Remediation Tracking &amp; Reporting</li></ul></li><li>
Collaborate with IT and DevOps teams to ensure timely remediation of vulnerabilities</li><li>
Conduct regular and ad-hoc vulnerability scans using tools like Wiz or Tenable</li><li>
Integrate tools with all cloud environments. Ensure complete coverage of all IT environments.</li><li>
Ensure alignment with internal security policies, regulatory requirements (NIST/SOC), and industry best practices.</li><li>
Support audits and assessments by providing evidence and documentation.<ul><li>
Stakeholder Engagement</li></ul></li><li>
Act as a liaison between security, IT, development, and risk teams</li><li>
Provide clear, actionable recommendations tailored to technical and non-technical audiences.<ul><li>
Mentor Junior Analysts</li></ul></li><li>
Provide guidance and training to junior members of the VCM team.<ul><li>
Process Improvements</li></ul></li><li>
Identify potential gaps in the vulnerability or compliance management programs and propose improvements.</li><li>
Develop and maintain Standard Operating Procedures, Frameworks, and Job Aids/HowTos.</li></ul>
QUALIFICATIONS:<p></p><p><b><br>
Education</b>
</p><ul><li>Bachelor's Degree or equivalent required.BA/BS degree in Computer Science, Information Systems, Cyber Security or a related technical field. Master&rsquo;s Degree is a plus.</li></ul><div></div><p><b><br>
Minimum Experience</b></p><p><br>
</p><ul><li>Minimum of 7 years of experience with security engineering and operations, as well as experience managing and supporting large, complex mission-critical systems and with Vulnerability management tools, patching processes and tools, VM operation/workflow, or configuration/Baseline/File-integrity monitoring applications and processes.</li><li>
Applicants must be authorized to work in the US without requiring employer sponsorship currently or in the future. U.S. FinTech does not offer H-1B sponsorship for this position.</li></ul><div></div><div><b><br>
Specialized Knowledge &amp; Skills</b><br>
</div><div></div><ul><li>Subject matter expert of cloud based critical infrastructure systems and security threats for these systems (AWS Cloud experience required)</li><li>
Subject matter expert with cyber security in the domains of vulnerability and compliance management.</li><li>
Familiarity with latest security vulnerabilities, advisories, incidents, penetration techniques, understanding of attacks, and determination of countermeasures.</li><li>
Subject matter expert of network and system vulnerabilities, malware, networking protocols, multi-tiered applications, and attack methods to exploit vulnerabilities.</li><li>
Experience in senior technical security role, including network security, operating system security, Internet or Web security, and vulnerability testing.</li><li>
Strong knowledge of networking fundamentals such as TCP/IP and basic packet analysis, network engineering, and local and wide area (LAN/WAN) technologies and topologies.</li><li>
Must have experience conducting comprehensive vulnerability assessments with vulnerability monitoring tools (Wiz and Tenable).</li><li>
General knowledge and experience in Windows / Linux Operating Systems, baseline security configurations, audit, forensics, Patch Management for these OSs.</li><li>
Experience developing Standard Operating Procedures (SOPs), job aids, and hands-on training materials.</li><li>
Be able to work in fast paced environment with occasional on-call activities.</li><li>
Excellent interpersonal skills, presentation skills, and verbal / written communication skills.</li><li>
Self-starter; adaptable to change; motivated to set personal and program goals and pro-actively track performance against goals and initiatives.</li><li>
Ability to manage multiple priorities &ndash; projects, deliverables, and stakeholders.</li><li>
Ability to influence peers and management; ability to team cross-functionally and form relationships to achieve objectives.</li><li>
Active in the security industry; equipped with external networking relationships to maintain relevant knowledge of best practices, tactics, strategies and technologies.</li><li>
AWS Security, AWS Architect certifications desired.</li></ul><div>
Pay Range $156,500 to $181,000</div><div>
U.S. FinTech's pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) a candidate&rsquo;s qualifications, skills, competencies, and experience, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law. U.S. FinTech offers a competitive total compensation package, which includes a performance bonus, 401k match, healthcare coverage, PTO, and a broad range of other benefits.</div><div></div><p><b><br>
Employment</b></p><p>
As a condition of employment with U.S. Financial Technology, any successful job applicant will be required to successfully complete a background investigation, which may also include a credit check for positions in some areas of our business.<br>
</p><p></p><p>U.S. Financial Technology is an Equal Opportunity Employer.</p><p></p><p><br>
##LI-Remote</p></div>

Lead, Security Engineer V&CM

البنك التجاري الدولي

<div></div><div><div>Description<div></div><p><br>
JOB PURPOSE</p>
<p>
Ensure the confidentiality, integrity, and availability of an organization's information systems and data and effective implementation of security measures within development processes through integrating security into the operational and development processes to support the organization in streamlining and enhancing the development processes In addition, work closely with cross-functional teams to integrate security practices into their workflows and ensure that security is considered throughout the software development lifecycle, collaborate with stakeholders, manage security initiatives, and provide guidance on secure coding practices. responsible for identifying and mitigating security risks, conducting security assessments, and ensuring compliance with relevant regulations and standards to help improve software reliability, security, and quality.</p>
<p>
4. KEY ACCOUNTABILITIES</p>
<p>
Description</p>
<p>
1. Collaborate with cross-functional teams to integrate security practices into development processes and create seamless flow of work.</p>
<p>
2. Provide guidance and support on secure coding practices, secure design principles, and security risk mitigation.
</p><p>3. Develop and maintain security documentation and guidelines for Continuous Integration / Continuous Development CI/CD pipeline tools and processes. Additionally, Design and implement secure (CI/CD) pipelines for building, testing and deploying software, incorporating security testing tools such as Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST) and Software Composition Analysis (SCA)</p>
<p>
4. Evaluate and recommend the implementation of security tools and technologies to enhance the security posture of the organization within the CI/CD pipeline.
</p><p>5. Responsible for the security of the software development process, including automating scans, code verification, and developing security protocol to protect sensitive data and ensure proper prevention against cyber threats.</p>
<p>
6. Review and enhance containers&rsquo; security measures within the bank IT environment (e.g. Kubernetes, OpenShift, etc)
</p><p>7. Collaborate with both development and operations teams to create a seamless flow of work and maintain an agile workflow.</p>
<p>
8. Ensure continuous integration and delivery (CI/CD) processes are followed, promoting the speedy release of high-quality software</p>
<p>
9. Support the implementation of the key strategic business initiatives and projects through following the secure software development life cycle including specifying the confidentiality, integrity, and availability requirements, addressing security requirements throughout the development of new systems and performing proper risk assessment prior to releasing new systems to production.</p>
<p>
10. Review new technologies and changes to existing technologies for in house developed applications to ensure proper information security requirements/controls and compliance with relevant security policies and compliance mandates.</p>
<p>
11. Conduct the annual review and update of the area&rsquo;s processes, procedures and recommend updates to relevant policies with the adherence to the developed SLAs.</p>
<p>
Policies, Processes and Procedures</p>
<p>
12. Participate, develop and recommend improvements to policies, processes and procedures and manage their implementation to ensure all relevant procedural / legislative requirements are fulfilled.</p>
<p>
Day-to-day management</p>
<p>
13. Follow the day-to-day operations related to own jobs in the Information Security Management department to ensure continuity of work.</p>
<p>
Compliance</p>
<p>
14. Ensure compliance with relevant laws, regulations, and industry standards (e.g., CBE, PCI-DSS, ISO 27001).</p><div><br>
</div></div><div>
Qualifications<div></div><p><br>
QUALIFICATIONS, EXPERIENCE, &amp; SKILLS</p><p>
Qualifications &amp; Experience</p><p>
 Bachelor's degree in Computer Science, Information Security, or a related field. A master's degree is preferred.</p><p>
 3-6 years of proven experience in a similar security-focused role. (5-8 years for Sr. analyst)</p><p>
 Proven experience as a DevSecOps Engineer or similar role, with strong background in software development lifecycle and security</p><p>
 Strong knowledge of secure coding practices, secure design principles, and common security vulnerabilities.</p><p>
 Familiarity with agile development methodologies and experience integrating security into agile processes.</p><p>
 Knowledge of industry regulations and standards such as ISO 27001, NIST, OWASP, etc.</p><p>
 Abroad understanding of security practices such as penetration testing, threat modelling, vulnerability management and static &amp; dynamic application security testing</p><p>
 Experience with CI/CD tools such as Gitlab CI/CD, version control systems, code repositories, etc.</p><p>
 Experience with containerization and orchestration tools (e.g. Docker, Kubernetes, Helm, ArgoCD)</p><p>
 Knowledge of scripting languages (e.g. Bash, Python, Go)</p><p>
 Experience conducting security assessments, vulnerability testing, and risk assessments.</p><p>
 Familiarity with security tools and technologies such as vulnerability scanners, code analysis tools, etc.</p><p>
Recommended Certification:</p><p>
 CISSP</p><p>
 CISM</p><p>
 CSSLP</p><p>
 GIAC Cloud Security Automation (GCSA)</p><p>
 Certified DevSecOps Engineer (CDSOE)</p><p>
 Certified DevSecOps Professional (CDP)</p><p>
 DevSecOps Engineering (DSOE)</p><p>
 Certified Ethical Hacker (CEH)</p><p>
 Offensive Security Defense Analyst (OSDA)</p><p>
Skills</p><p>
 Excellent communication and collaboration skills</p><p>
 Strong problem-solving and analytical skills</p><p>
 Proficient verbal and written English</p><p>
 Ability to manage and prioritize tasks</p><p>
 Knowledge of top-level cybersecurity subjects and issues</p><p>
 Ability to research threats and draw up logical conclusions through well-thought-out, unbiased processes</p><p>
 Ability to troubleshoot and solve problems</p><p>
 Ability to learn new technologies quickly</p><p>
 Ability to bring together data from diverse sources and articulate it into simple and concise information</p><div><br>
</div></div><div>
Primary Location: Egypt-Giza-SMART VILLAGE BLDG. 1</div><div>
Job: Back Office</div><div>
Organization: FINANCE, STRATEGY, OPERATIONS &amp; TECHNOLOGY</div><div>
Shift: Day Job</div><div>
Job Type: Full-time Employee</div><div>
Travel: No</div></div>

DEVSECOPS SENIOR ANALYST / SENIOR ANALYST

Search 2050+ Vulnerability assessment analyst jobs near you this June. New roles added regularly across leading industries. Apply today.