Solution Architect - Vulnerability Management Long-Term

Project overview

Key Data:

Role: Solution Architect – Vulnerability Management

Period: ASAP until 31.12.2026 (extension likely until 31.12.2027)

Utilization: Full-time

Project details

Primarily remote & on-site in Germany as needed

Service Description

Qualification and Experience Requirements (Must-haves)

Should-haves

Have we sparked your interest?

Then send us your CV in Word format and your current availability, including your hourly rate, to: anna.puskaric AT deedcon.de

Sincerely

Anna Puskaric/ Recruiter

• Analysis and evaluation of existing vulnerability management processes, detection tools, data sources, and remediation paths
• Conception of an end-to-end process from vulnerability findings to demonstrable remediation
• Definition of scope and detection methods across networks, operating systems, containers, platform configurations, and applications
• Establishment of a supply of vulnerability and threat data for air-gapped or non-permanently connected environments
• Development of a risk-based assessment and prioritization model considering environment context, exploitability, and active threat landscape
• Conception of a deadline model for vulnerability remediation in coordination with procurement and import channels
• Establishment and anchoring of exception, risk acceptance, and escalation procedures
• Consolidation of findings from different detection paths and tools into a unified situational picture
• Definition and introduction of control metrics and reporting for vulnerability management
• Practical implementation of developed processes and concepts in a pilot environment
• Development of a roadmap for subsequent expansion to other systems, asset units, and zone types
• Minimum 6 years of experience in establishing vulnerability management processes, not exclusively in operating existing solutions or using individual tools
• Minimum 6 years of experience with self-operated detection tools in environments without network connectivity, especially for networks, operating systems, container images, and configurations
• Minimum 6 years of experience with the controlled import of audit modules, vulnerability data, and updates into air-gapped environments, as well as handling resulting data staleness
• Minimum 6 years of experience with risk-based prioritization of vulnerabilities beyond simple severity ratings, especially using data on exploitability, active exploitation, and vendor advisories
• Minimum 6 years of experience with prioritization models for isolated environments, considering internal reachability, trust relationships, cross-tenant impact, and affected component supply chains
• Minimum 6 years of experience in establishing or improving robust asset and inventory data as a basis for vulnerability management
• Minimum 6 years of experience in developing deadline models for vulnerability remediation, considering procurement and deployment paths
• Minimum 6 years of experience in the functional enforcement of agreed remediation deadlines and in handling conflict and escalation situations
• Minimum 6 years of experience in designing exception and risk acceptance procedures, including robust documentation
• Minimum 6 years of experience in integrating vulnerability findings from development, build, and operational processes
• Minimum 6 years of experience in consolidating and deduplicating findings from different tools into a consolidated situational picture, including attack path validation
• Minimum 6 years of experience with control metrics such as remediation duration, asset aging, coverage rate, recurrence, and data freshness
• Minimum 6 years of relevant experience in the vulnerability management environment and proven practical experience with tools from several of the following areas:
• Network and Operating System Scanning: Greenbone/OpenVAS, Tenable, Qualys, Rapid7 InsightVM or similar
• Image and Configuration Auditing: Trivy, Grype, Clair, kube-bench, Checkov or similar
• Vulnerability and Threat Data: CVE, EPSS, KEV, CSAF, OVAL or similar
• Finding Consolidation: DefectDojo, OWASP Dependency-Track, Faraday or similar
• Asset Management: NetBox, i-doit, GLPI, ServiceNow or similar
• Task Management/Ticketing: Jira, GitLab, OTOBO/Znuny or similar
• Retrieval and preparation of vendor advisories and official security alerts for environments without direct network access
• Automated transfer of vulnerability findings to the task and ticketing systems of the business units
• Own auditing experience for assessing and validating the quality of vulnerability findings
• Vulnerability management in public cloud environments and transfer of corresponding procedures to self-operated infrastructures
• Proof of compliance and documentation towards internal or external audit bodies
• Start: ab sofort
• Duration: 3 Monate
• Remote: remote
• Location: deutschlandweit, Deutschland, DE
• Languages: German