漏洞管理（Qualys安全分析师）
Vulnerability Management (Qualys Security Analyst)
首要职责和责任 • 在部署前与系统的网络和漏洞扫描进行协调，执行和调整以及在生产前和生产环境中修改这些系统时与客户合作•负责理解，审查和解释评估和扫描结果，减少虚假积极发现，并作为客户的可靠安全顾问。•学习和适应客户文化，安全策略，安全目标，安全目标和安全能力•确定客户对新兴和零日的组织立场和姿势 保持对客户漏洞管理服务所涉及的未知漏洞管理问题知识，并酌情向客户传达更新信息• 进行漏洞评估扫描和指导，假正确验证，合规扫描以及扫描配置文件和政策创建• 为系统管理人员，系统所有者和 IT 支持人员提供有效的漏洞缓解策略，有意义的漏洞衡量标准，安全控制或纠正措施来减轻技术和业务进展风险•制定和报告企业级漏洞和补救测量标准 了解，展示和教育有关特定环境中的威胁和漏洞利用的现实影响利益相关者•管理多个客户请求，评估，并在既定服务水平内满足客户期望 资格 安全威胁分析背景确定识别的威胁风险程度以及必要的应对紧迫性的能力 •具备强大的技术理解共同网络和系统脆弱性 了解网络原则 （OSI 模型，路由，TCP/IP）Windows 和 Linux 操作系统和基本管理 常见安全技术最佳实践 在快速发展的生产环境中，客户面临24小时工作能力和解决问题；•在地理分布式环境下与跨企业及跨职能团队合作经验。•建立扫描资料，进行日常扫描环境，监督修复工作等。
查看英文原文
Primary Duties and Responsibilities
Work with customers to coordinate, conduct, and tune network and system
vulnerability scans prior to deployment and when those systems are modified within
pre-production and production environments
Responsible for understanding, reviewing, and interpreting assessment and scanning
results, reducing false positive findings, and acting as a trusted security advisor to
the client.
Learn and adapt to client’s culture, security strategies, security goals, security
objectives, and security capabilities
Identify client’s organizational position and posture against emerging and zero day
Maintain knowledge of outstanding vulnerability management issues as it pertains to
the Client’s Vulnerability Management Service and communicate updates to Client as
appropriate
Present Vulnerability Assessment Scanning and guidance, False Positive Validation,
Compliance Scanning and, scan profile and policy creation
Provide system administrators, system owners, and IT support staff with effective
vulnerability mitigation strategies, meaningful vulnerability metrics, security controls
and or corrective actions for mitigating technical and business risk
Develop and report enterprise-level metrics for vulnerabilities and remediation
progress
Understand, demonstrate, and educate stakeholders on the real-world impact of
threats and vulnerability exploitation in a given environment
Manage multiple customer requests, assessments, and meet customer expectations
within established service levels
Qualifications
Background in security threat analysis – ability to determine risk level of identified
threats and necessary urgency in remediation
Possess strong technical understanding of common network and system
vulnerabilities
Understanding of networking principles (OSI Model, routing, TCP/IP)
Windows and Linux operating systems, and basic administration
Best practices in common security technologies
Problem solving skills and ability to work under pressure in a rapid paced, customer
facing 24/7 production environment
Experience working with cross-business and cross-functional teams in a
geographically distributed environment
Setting up scanning profiles, conducting routine scans of our environment, oversee
remediation efforts, etc.
Willingness to share on-call responsibilities, work non-standard hours, and travel
when required
Willingness to accept direction, support leadership vision, and to serve as a point of
contact directly supporting vulnerability assessments, system owners, and executives
Excellent written and verbal communication skills
Must Have Skills
Minimum 2 years of experience with Qualys
Experienced in setting up scanning profiles, conducting routine scans of security
environment, oversee remediation efforts, etc.
Originally posted on Himalayas