Vulnerability Management Specialist

VULNERABILITY MANAGEMENT SPECIALIST (HYBRID PORTO):
Portuguese company hires for hybrid position
Location: Porto, Portugal
Work Model: Hybrid
️ Language Requirements: Very good written and spoken English (mandatory)
Seniority: Senior (5+ years)
Sector: Banking
Rate Between €*** RV / €*** CTI
- ️ Instructions: Please send your CV in English and make sure to include all skills and experience that match the requirements of the opportunity.
This will significantly increase your chances of success
About the Opportunity:
You will join a corporate cybersecurity function responsible for ensuring that technology assets are regularly assessed, vulnerabilities are correctly prioritised, and remediation actions are completed within the expected timelines.
This transversal role provides exposure to different technology environments, business areas, and international cybersecurity teams.
You will coordinate with asset owners, IT teams, security specialists, external providers, and other stakeholders to improve vulnerability-management processes and reduce cyber risk.
Main Responsibilities:
Vulnerability Scanning
- Ensure that all relevant technology assets are covered by approved vulnerability-scanning tools.
- Monitor whether assets are scanned regularly and successfully.
- Identify missing assets, scanning failures, and coverage gaps.
- Analyse vulnerability-scan results.
- Assess and prioritise vulnerabilities according to their severity, exposure, and business impact.
- Define and propose appropriate remediation plans.
- Follow up with the relevant entities and asset owners until remediation is completed.
- Escalate overdue or high-risk vulnerabilities when necessary.
- Produce regular and on-demand vulnerability reports.
Critical Patch Management
- Analyse information concerning critical security patches.
- Alert the teams and entities impacted by critical vulnerabilities and patches.
- Monitor the deployment and implementation of critical patches.
- Track remediation progress and identify delays or blockers.
- Formalise and communicate clear progress reports to stakeholders.
- Support risk-based prioritisation when immediate patching is not possible.
Penetration Testing
- Coordinate and request penetration tests on behalf of internal entities.
- Monitor the planning, execution, and delivery of penetration-testing activities.
- Review and analyse penetration-test findings.
- Prioritise identified weaknesses and propose remediation plans.
- Monitor remediation activities through to closure.
- Evaluate the quality of services delivered by penetration-testing providers.
- Ensure testing services and reports comply with internal cybersecurity requirements.
- Collaborate with internal stakeholders and external security providers.
Secure Code Review
- Identify coverage gaps, scanning failures, and unresolved findings.
Mandatory Requirements:
- Minimum of five years of professional experience in IT.
- Experience or strong knowledge in vulnerability management.
- Understanding of vulnerability scanning and remediation processes.
- Ability to analyse technical security findings and prioritise remediation activities.
- Knowledge of critical patch-management processes.
- Understanding of penetration-testing activities and reporting.
- Ability to monitor remediation actions and ensure effective follow-up.
- Experience producing regular and on-demand operational reports.
- Advanced Microsoft Excel skills.
- Strong analytical and organisational abilities.
- Ability to lead meetings and communicate with different stakeholders.
- Very good written and spoken English.
- Availability to travel within Portugal and internationally.
Nice-to-Have Requirements:
- Previous professional experience in cybersecurity.
- Experience in banking, insurance, financial services, or another regulated industry.
- Knowledge of vulnerability-management tools such as Qualys, Tenable, Rapid7, or similar platforms.
- Familiarity with CVE, CVSS, CWE, and vulnerability severity classification.
- Experience with SAST, DAST, SCA, or secure code-review tools.
- Knowledge of penetration-testing methodologies.
- Understanding of risk acceptance and vulnerability-exception processes.
- Experience with cybersecurity KPIs, dashboards, and executive reporting.
- Knowledge of Power BI or other data-visualisation tools.
- Familiarity with security standards or frameworks such as ISO *, NIST, CIS Controls, or OWASP.
- Relevant cybersecurity certification.
Soft Skills:
- Rigorous and highly detail-oriented approach.
- Dynamic and proactive attitude.
- Strong focus on deliverables and deadlines.
- Client
- and stakehold