Sr Cybersecurity Analyst

Description

You will be the senior specialist and overseer for vulnerability management, attack surface management, continuous threat exposure management (CTEM) and penetration testing oversight.

The company provides clinical research services, commercial insights and healthcare intelligence to life sciences and healthcare organisations.

Responsibilities

• Run vulnerability management, external attack surface management and CTEM from asset discovery and scanning through risk-based prioritisation, remediation tracking and confirmed closure.
• Lead and direct the analysts in your area and serve as the escalation point for complex, disputed or zero-day exposures.
• Help build and maintain governance, including standard operating procedures, remediation SLAs, risk-acceptance and exception workflows, and KPIs.
• Control the penetration testing programme: set scope and rules of engagement, coordinate internal and third-party testers, check report quality and drive findings through remediation and retest.
• Combine threat intelligence with internal and external exposure data so remediation targets what is exploitable and business-critical.
• Give senior leadership regular performance updates and exposure risk reports.
• Act as the subject matter expert on problems that need detailed knowledge of your area.

Requirements

• Bachelor's degree in computer science, a related field or equivalent experience.
• Work experience can substitute for the degree (Preferred).
• 5 years of related work experience, including 3 years in vulnerability or exposure management.
• Fluent written and spoken English.
• Hands-on experience with vulnerability management and risk-based VM platforms, external attack surface management (EASM), exposure management and CTEM platforms, threat intelligence platforms (TIP), cloud security posture management (CSPM/CNAPP), breach and attack simulation (BAS) or other exposure validation tools, and ITSM and CMDB systems for remediation workflows.
• Strong knowledge of CVSS, EPSS, known-exploited vulnerability catalogs, MITRE ATT&CK and OWASP Top 10.
• Working knowledge of at least one major public cloud provider, plus networking, Windows and Linux.
• Scripting or API automation in Python or PowerShell, and data reporting or BI tools (Preferred).
• Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM) and Certified in Risk and Information Systems Control (CRISC).
• Technical certification such as GIAC GEVA, GCED or GPEN, OSCP, CompTIA PenTest+ or a cloud security certification (Preferred).

Conditions

The company has zero tolerance for candidate fraud, and any false or misleading application information can lead to disqualification or dismissal if found later.

The company is committed to diversity, inclusion and equal treatment of women and men.