Lead Security Consultant Vulnerability Management

Project overview

At virtual7, we combine our technological expertise with a deep understanding of our clients' needs. Through tailor-made solutions, we create real added value for our framework agreement partners in public administration. We are currently looking for a Lead Security Consultant Vulnerability Management (m/f/d) for one of our clients.

YOUR MISSION

At our client's site, vulnerability management is being brought up to the latest standard.

• Project location: Bonn
• Period: November 16, 2026 to December 31, 2026
• Work mix: 30 days remote / 4 days on-site
• Important: Remote work only possible within Germany
• Important: Project language is German
• Important: Willingness for SÜ2 according to § 9 SÜG (classified information/sabotage protection)
• Extension for 2027 possible

Responsibilities

MUST-HAVES FOR THIS POSITION

NICE TO-HAVES FOR THIS POSITION

If you are interested and currently have free capacity, we look forward to your application. Our recruiting team with Alicja Okuniewicz, Anna-Lena Röcker, Jörg Becker – looks forward to talking with you.

virtual7 Recruiting Team

Mail: *@*.de

JobLink: https://virtual7jobs.recruitee.com/o/lead-security-consultant-schwachstellen-management-mwd

• Recording of detection tools, data sources, remediation paths, including the practiced methods in operational areas
• Assessment of which can remain viable
• Design of the process for the lifecycle of a vulnerability
• Definition of scope of capture, detection methods across networks, operating systems, containers, platform configurations, and applications
• Setup of the supply of vulnerabilities and threat data in isolated zones, including tempo and update rate
• Deadline model in coordination with the import tempo of the gateway, anchoring deadlines with system administrators
• Exception and risk acceptance procedures, including who signs off in the pilot
• Implementation in the pilot inventory, roadmap with effort per inventory unit and per zone type
• min. 6 years of experience building vulnerability management
• min. 6 years of experience operating detection tools without network connection via network, operating systems, images, configuration
• min. 6 years of experience with prioritization beyond severity score, supported by actionable data sources on exploitability
• min. 6 years of experience handling the central weakness of a topic
• min. 6 years of experience with the ability to design a deadline model
• min. 6 years of experience enforcing agreed-upon deadlines
• min. 6 years of experience designing an exception and acceptance procedure
• min. 6 years of experience integrating findings paths between build time and operation
• min. 6 years of experience consolidating findings from different tools
• min. 6 years of experience with control metrics
• min. 6 years of experience with Greenbone/OpenVAS, Tenable, Qualys, Rapid7 InsightVM
• min. 6 years of experience with Trivy, Grype, Clair, kube-bench, Checkov
• min. 6 years of experience with CVE and EPSS data, KEV catalog, manufacturer notices according to CSAF or OVAL
• min. 6 years of experience with DefectDojo, OWASP Dependency-Track, Faraday
• min. 6 years of experience with NetBox, i-doit, GLPI, ServiceNow
• min. 6 years of experience with Jira, GitLab, OTOBO/Znuny
• Experience with sourcing and processing manufacturer notices and official warnings
• Experience with own auditing experience for assessing finding quality
• Experience with vulnerability management in public cloud environments

Project details

• Start: 2026-11
• Duration: 2 Monate
• Remote: hybrid
• Location: Bonn, Deutschland, DE
• Languages: German