What you will do:

The Johnson Controls Global Cyber Security (GCS) team is undergoing a transformation and expansion as Johnson Controls increases its cybersecurity resources and capabilities in order to address the ever-changing cybersecurity threat landscape. 

The Sr. Vulnerability Analyst for Vulnerability Management will be responsible for overseeing and leading the vulnerability management program within the organization. This role involves identifying, evaluating, and mitigating security vulnerabilities across the company's IT infrastructure and applications. The ideal candidate will have a deep understanding of cybersecurity principles, strong leadership skills, and a proven track record of managing vulnerability management teams and programs. This role will report to the Sr. Manager Vulnerability Management.

The candidate will be able to articulate thoughts clearly, run operations, plan initiatives, and execute with appropriate urgency. The candidate will demonstrate drive, intelligence, maturity, and energy and will be a proven change agent.

How you will do it:

• Develop and execute a comprehensive vulnerability management strategy aligned with the organization’s security objectives.
• Lead and manage the vulnerability management team, providing guidance, mentorship, and professional development opportunities.
• Collaborate with cross-functional teams to integrate vulnerability management processes into the overall security program.
• Oversee regular vulnerability assessments and penetration testing to identify potential security weaknesses.
• Work closely with IT and development teams to develop and implement effective remediation plans.
• Coordinate and/or perform regular Infrastuctural and Web Application vulnerability assessments;
• Identify, and maintain the vulnerability management corporate platform in order to prompt identify weakness in the internal and external perimeter, including Cloud infrastructure;
• Monitor the identified security vulnerabilities or missconfiguration and support the IT stakeholders for remediation;
• Enforce VM processes and procedures to ensure also the right coverage and security of the Corporate Business Infrastructure and Web Applications;
• Collaborate with GIS teams to develop or optmize automations used for vulnerability tracking and reporting;
• Support to adopt Secutiy best practices and security standards applied by the organization.

What we look for:

Required

• Minimum 10 years working in Information Security and Security Operations area.
• Knowledge of industry best practices in Vulnerability Management and Compliance areas; (e.g. NIST and “CVSS - Common Vulnerability Scoring System” frameworks)
• Experience in management and configuration of vulnerability assessment platform (e.g Rapid7 Insight VM and AppSec, Nessus, Qualys VM and WAS, Burp Suite, ZAP)
• Experience with administration of ITSM solutions used for vulnerability tracking and reporting (Service Now SecOps VM Module/Jira)
• Experience with OWASP Top 10 assessment and methodology and CIS hardening standard;
• Experience with various cloud providers (Azure, Google, Amazon) and knowledge on methodology how to secure them;
• Experience on enforcement of VM operational Security process and procedures;
• Experience with penetration test assessment, red/blue team activities and security monitoring;
• Excellent verbal, written, and interpersonal communications skills, including the ability to communicate security concepts to both technical and non-technical audiences.
• Demonstrated ability to effectively facilitate and drive organizational change.
• Strong verbal and written communication skills.
• Excellent analytical, problem-solving, and decision-making skills.
  

Preferred

• Bachelor’s degree in computer engineering, computer security or computer science discipline;
• Previous technical background in IT or Software development roles;
• Experience with management of Service NOW SecOps Vulnerability Response module.
  

Desired Security certifications:

• Certified Information Systems Security Professional (CISSP)
• Certified Ethical Hacker (CEH)
• Offensive Security Certified Professional (OSCP)
• CompTIA Security+
• Qualys Certified Specialist
• Burp Suite Certified Practitioner