Lead Security Consultant Vulnerability Management (m/f/d) +++ FREELANCE +++ FULL-TIME +++ 12M+ +++ REMOTE

Project overview

for our client, we are looking for a freelancer for the following role / project in full-time and remote:

Lead Security Consultant Vulnerability Management (m/f/d)

Setup and implementation of a holistic vulnerability management process for on-premises infrastructures and partially isolated network zones. Focus: risk-based prioritization, offline supply with vulnerability data, central finding correlation, and demonstrable remediation.

Responsibilities

Must-haves

Nice-to-haves

Project Results

If interested, I need your current CV (in WORD) with your remote hourly rate by Monday, October 12, 2026, EOB.

Additionally, a self-assessment (1=Basic knowledge / 5=Expert knowledge) for EACH of the above points (each line = one rating).

Tolga Yelkenci

Manß & Partner GmbH

*@*.de

• Conception and implementation of a continuous vulnerability management process from finding to proven remediation
• Recording and optimization of existing scanners, data sources, and remediation processes
• Integration of vulnerability detection for networks, operating systems, virtual machines, containers, configurations, and applications
• Setup of an offline supply with current vulnerability and threat data for isolated network zones
• Development of a risk-based prioritization model considering exploitability, system context, and internal trust relationships
• Consolidation and deduplication of findings from different scanners and platforms
• Definition and enforcement of risk-based remediation deadlines, including exception and risk acceptance procedures
• Integration of vulnerability management into development and operations
• Setup of key figures, reporting, and traceable remediation evidence
• Technical implementation and validation in the pilot area, as well as creation of a rollout roadmap
• 6-10 years of practical experience in setting up and implementing vulnerability management processes, not exclusively in scanner operation
• Sound experience with vulnerability scanners for networks and operating systems, e.g., Tenable, Qualys, Rapid7 InsightVM, or Greenbone/OpenVAS
• Experience with vulnerability detection in on-premises and isolated environments without direct internet connection
• Setup and operation of controlled offline updates for scanners, analysis modules, and vulnerability databases
• Risk-based vulnerability prioritization beyond CVSS, considering EPSS, KEV, vendor warnings, and system context
• Experience with asset inventory, coverage, and the quality of CMDB or inventory data
• Development of remediation deadlines and SLAs considering technical dependencies and limited procurement channels
• Implementation of exception and risk acceptance procedures, including traceable documentation
• Correlation, deduplication, and consolidation of findings from different tools into a central situational picture
• Linking of vulnerability findings from development, build process, and IT operations
• Definition and evaluation of KPIs such as remediation time, coverage, overdue findings, recurrence, and timeliness of vulnerability data
• Independent technical implementation of the developed processes and tools in pilot operation
• Very good German language skills, spoken and written
• Vulnerability data and Threat Intelligence: CVE, CVSS, EPSS, CISA KEV, CSAF, and OVAL
• Scanners and Security Assessment: Tenable, Qualys, Rapid7 InsightVM, Greenbone/OpenVAS
• Container and Configuration Scanning: Trivy, Grype, Clair, kube-bench, Checkov
• Finding Correlation and Management: DefectDojo, OWASP Dependency-Track, Faraday
• Asset and CMDB Management: ServiceNow, i-doit, GLPI, NetBox
• Ticketing and Workflow Automation: Jira, GitLab, OTOBO/Znuny
• Experience with attack path validation and assessment of internal reachability, trust relationships, and cross-tenant impacts
• Automated transfer of findings into ticketing systems and workflows of business units
• Experience with vendor and authority warnings in isolated environments
• Experience with vulnerability management in regulated infrastructures and with proof requirements from auditors
• Transfer of vulnerability management procedures from public cloud environments to self-operated infrastructures
• Certifications such as CISSP, GIAC in the security assessment field, or OSCP
• Implemented vulnerability management process from finding to proven remediation
• Functioning vulnerability detection and data supply, even in isolated network zones
• Unified, deduplicated situational picture across various detection tools
• Established prioritization, deadline, and risk acceptance model
• Measurable KPIs and documented rollout plan

Project details

• Start: ab sofort
• Duration: 12 Monate
• Location: DE
• Rate: 12-12 EUR/h
• Languages: German