Vulnerability Response Analyst: Exploitability & Risk Assessment (Remote)

Role Summary

The Vulnerability Response Analyst will assess and prioritize critical cybersecurity vulnerabilities across a global financial institution’s technology environment. This role focuses on determining real-world exploitability, business impact, affected assets, and appropriate remediation urgency rather than relying solely on scanner output or published severity scores. The analyst will collaborate with application and infrastructure owners, contribute to urgent incident calls, and document audit-ready decisions in a follow-the-sun operating model.

Responsibilities

• Triage critical vulnerabilities, typically those with CVSS scores of 9.0 or higher, from a prioritized queue.
• Review asset and inventory data to identify affected systems, including assets not covered by vulnerability scanners.
• Conduct vulnerability risk assessments using threat intelligence, exploitability analysis, proof-of-concept feasibility, and compensating controls.
• Model realistic attack paths involving widely deployed runtimes and open-source components, including PHP and Node.js.
• Assign firm-specific severity ratings in addition to CVSS, including environmental scoring, and participate in peer review.
• Interpret security advisories, proof-of-concept code, vulnerability disclosures, and independent security research.
• Collaborate with application and infrastructure owners to support timely remediation of critical findings.
• Participate in urgent incident calls for vulnerabilities requiring immediate action.
• Produce clear, technically accurate, and audit-ready case notes.
• Coordinate effective handoffs across North America, London, and Singapore time zones.

Qualifications

• Hands-on experience with vulnerability triage and cybersecurity risk assessment.
• Strong knowledge of CVEs, CPEs, CVSS, and environmental scoring.
• Ability to evaluate exploitability beyond scanner output and model how an attacker could use a vulnerability in a real environment.
• Working knowledge of how memory corruption, deserialization, injection, and other vulnerability classes can lead to outcomes such as code execution.
• Experience interpreting security advisories, proof-of-concept code, and technical research.
• Sound judgment when working with incomplete information, supported by clear technical writing and documentation skills.
• Background in penetration testing, red teaming, vulnerability research, exploit analysis, or threat intelligence is strongly preferred.
• Experience building or validating proofs of concept or performing static and dynamic analysis is strongly preferred.
• Familiarity with AI tools, agentic workflows, Microsoft, VMware, Oracle/Java, Citrix, F5, cloud environments, and large-scale open-source ecosystems is strongly preferred.
• Financial services or other regulated-industry experience is strongly preferred.

Publishing Pay Range: $70.00 – $85.00 hourly

This is a fully remote role and can be performed from an approved location.