The Vulnerability Management Engineer  is responsible for managing the identification, assessment, reporting, and mitigation of infrastructure and cloud vulnerabilities.

A candidate for this role will have a mindset of a defender and be able to operate in a fast-paced environment working closely with our infrastructure team that includes Network,

Firewall, Hypervisors, Servers, and business application teams.

Primary Skills:

• At least 7+ years’ experience in Information Security or Information Technology field.

• Bachelor’s degree in computer science, Information Security, or equivalent combined experience.

• Hands-on experience with a variety of vulnerability management and network scanning tools, such as Qualys, Tenable Security Center, Nmap, web scanners, etc.

• Understanding of the relationship between operating systems, applications, and their dependencies, and how interrelated software vulnerabilities exist – with ability to determine remediation techniques in diverse environments.

• Conduct regular vulnerability scans and assessments on network devices, servers, applications, and databases.

• Perform vulnerability metrics reporting for ad-hoc and scheduled metrics report for various KPIs (Key Performance Indicators) around vulnerability management activities.

• Knowledge of both Windows and UNIX-based operating systems (e.g. Windows Server and Client OS, RHEL, Ubuntu, Amazon Linux, MacOS), and container technologies (e.g. Kubernetes, Docker).

• Ability to script and program using Python and other scripting and programming languages (i.e. SQL, Python, C, Java, JavaScript), notably for working with RESTful APIs.

• Perform regular security audits and compliance checks to ensure adherence to security policies and standards.

• Experience working with REST APIs and integrating API frameworks into wider business intelligence solutions.

• Ability to analyse vulnerabilities to appropriately characterize threats and provide remediation advice. Familiarity with classes of vulnerabilities, appropriate remediation, and industry-standard classification schemes (CVE, CVSS, CPE).

• Capable of independently managing customer requirements, from the initial information gathering phase through to implementation.

Secondary Skill:

• Knowledge of the DORA Standard.

• Solid experience in offensive security, adversarial tactics, techniques, and procedures (e.g. using MITRE ATT&CK framework), and common attack patterns such as binary exploitation, memory corruption, race conditions, web attacks, etc.

• In-depth knowledge of security standard methodologies, technologies and products and aim to continuously improve these skills.

• Knowledge of CI/CD pipelines, GitHub or other version control systems, and cloud hosting environment’s (i.e. AWS) applicable security standard methodologies.

• Experience working in agile project management toolsets, creating tickets which break down work into manageable pieces, tracking capacity, and closing stories in a timely manner, and documenting work (i.e. Jira, Confluence, ServiceNow).

Soft Skill:

• Good experience working with numerous external teams to track and deliver solutions.

• Strong detail-oriented individual able to efficiently analyze and resolve problems.

• Strong verbal, communication, and diplomacy skills with all levels of the business.

• Must be self-motivated, able to work independently, and multi-task effectively.

Skills Desired:

• Exposure or knowledge of cloud architectures, services, and vulnerabilities.

• Understanding of risk assessment methodologies.

• Proficiency in using vulnerability scanning tools such as Qualys etc.

• Qualys, MDE & C, SNS, Excellent in Excel.

• Ability to interpret vulnerability data from multiple sources.

• Reporting and metrics expertise with platforms such as Splunk, PowerBI, etc

Summary:

The Vulnerability Management Engineer  is responsible for managing the identification, assessment, reporting, and mitigation of infrastructure and cloud vulnerabilities.

A candidate for this role will have a mindset of a defender and be able to operate in a fast-paced environment working closely with our infrastructure team that includes Network,

Firewall, Hypervisors, Servers, and business application teams.

Primary Skills:

• At least 4+ years’ experience in Information Security or Information Technology field.

• Bachelor’s degree in computer science, Information Security, or equivalent combined experience.

• Hands-on experience with a variety of vulnerability management and network scanning tools, such as Qualys, Palo Alto, Tenable Security Center, OpenVAS, Nmap, web scanners, etc.

• Understanding of the relationship between operating systems, applications, and their dependencies, and how interrelated software vulnerabilities exist – with ability to determine remediation techniques in diverse environments.

• Conduct regular vulnerability scans and assessments on network devices, servers, applications, and databases.

• Perform vulnerability metrics reporting for ad-hoc and scheduled metrics report for various KPIs (Key Performance Indicators) around vulnerability management activities.

• Knowledge of both Windows and UNIX-based operating systems (e.g. Windows Server and Client OS, RHEL, Ubuntu, Amazon Linux, MacOS), and container technologies (e.g. Kubernetes, Docker).

• Ability to script and program using Python and other scripting and programming languages (i.e. SQL, Python, C, Java, JavaScript), notably for working with RESTful APIs.

• Perform regular security audits and compliance checks to ensure adherence to security policies and standards.

• Experience working with REST APIs and integrating API frameworks into wider business intelligence solutions.

• Ability to analyse vulnerabilities to appropriately characterize threats and provide remediation advice. Familiarity with classes of vulnerabilities, appropriate remediation, and industry-standard classification schemes (CVE, CVSS, CPE).

Secondary Skill:

• Knowledge of the DORA Standard.

• Solid experience in offensive security, adversarial tactics, techniques, and procedures (e.g. using MITRE ATT&CK framework), and common attack patterns such as binary exploitation, memory corruption, race conditions, web attacks, etc.

• In-depth knowledge of security standard methodologies, technologies and products and aim to continuously improve these skills.

• Knowledge of CI/CD pipelines, GitHub or other version control systems, and cloud hosting environment’s (i.e. AWS) applicable security standard methodologies.

• Experience working in agile project management toolsets, creating tickets which break down work into manageable pieces, tracking capacity, and closing stories in a timely manner, and documenting work (i.e. Jira, Confluence, ServiceNow).

Soft Skill:

• Good experience working with numerous external teams to track and deliver solutions.

• Strong detail-oriented individual able to efficiently analyze and resolve problems.

• Strong verbal, communication, and diplomacy skills with all levels of the business.

• Must be self-motivated, able to work independently, and multi-task effectively.

Skills Desired:

• Exposure or knowledge of cloud architectures, services, and vulnerabilities.

• Understanding of risk assessment methodologies.

• Proficiency in using vulnerability scanning tools such as Qualys etc.

• Qualys, MDE & C, SNS, Excellent in Excel.

• Ability to interpret vulnerability data from multiple sources.

• Reporting and metrics expertise with platforms such as Splunk, PowerBI, etc

Your benefits:

·        We offer a hybrid work model which recognizes the value of striking a balance between in-person collaboration and remote working incl. up to 25 days per year working from abroad

·        We believe in rewarding performance and our compensation and benefits package includes a company bonus scheme, pension, employee shares program and multiple employee discounts (details vary by location)

·        From career development and digital learning programs to international career mobility, we offer lifelong learning for our employees worldwide and an environment where innovation, delivery and empowerment are fostered

·        Flexible working, health and wellbeing offers (including healthcare and parental leave benefits) support to balance family and career and help our people return from career breaks with experience that nothing else can teach

About Allianz Technology

Allianz Technology is the global IT service provider for Allianz and delivers IT solutions that drive the digitalization of the Group. With more than 13,000 employees located in 22 countries around the globe, Allianz Technology works together with other Allianz entities in pioneering the digitalization of the financial services industry.

We oversee the full digitalization spectrum – from one of the industry’s largest IT infrastructure projects that includes data centers, networking and security, to application platforms that span from workplace services to digital interaction. In short, we deliver full-scale, end-to-end IT solutions for Allianz in the digital age.

D&I statement

Allianz Technology is proud to be an equal opportunity employer encouraging diversity in the working environment. We are interested in your strengths and experience. We welcome all applications from all people regardless of gender identity and/or expression, sexual orientation, race or ethnicity, age, nationality, religion, disability, or philosophy of life.

Join us. Let´s care for tomorrow.

You. IT