: Vulnerability Management (VM) / VAPT Specialist

Location: Bengaluru, India

Experience: 4–5+ Years

Joining: Immediate Joiners Preferred

Job Summary hands-on expertise in vulnerability assessment, vulnerability intelligence, CVE analysis, exploitability assessment, and risk-based vulnerability prioritization.

The ideal candidate will be responsible for evaluating newly disclosed vulnerabilities, determining their relevance to enterprise assets, assessing real-world exploitability, assigning defensible risk ratings,

and supporting vulnerability management operations across large-scale enterprise and cloud environments.

Key Responsibilities

- Monitor and triage newly disclosed vulnerabilities, security advisories, CVEs, and vendor

security bulletins.
- Map vulnerabilities to affected enterprise applications, infrastructure, operating systems, and

technology assets.
- Assess vulnerability exploitability using threat intelligence, proof-of-concept (PoC) exploits,

known exploited vulnerability (KEV) catalogs, and attack-path analysis.
- Perform risk-based vulnerability prioritization considering CVSS scores, asset criticality,

exposure, business impact, and exploitation likelihood.
- Demonstrate strong working knowledge of CVE, CPE, CVSS v3.x/v4.0, CWE, and vulnerability

scoring methodologies.
- Analyze vulnerability advisories, technical disclosures, exploit code, and security research to

determine real-world risk and remediation urgency.
- Work with vulnerability scanning and management tools such as Qualys, Tenable/Nessus,

Rapid7, or equivalent platforms.
- Prepare clear, audit-ready vulnerability assessment records, technical justifications, risk

assessments, and remediation recommendations.
- Collaborate with infrastructure, application security,



cloud security, and remediation teams to

track vulnerabilities through closure.
- Support BAU vulnerability management operations, follow-the-sun handovers, urgent

escalations, and SLA-driven remediation activities.
- Evaluate vulnerabilities affecting enterprise technologies, including Microsoft Windows,

VMware, Oracle, Java, Citrix, F5, and open-source software.
- Understand vendor patch advisories, security updates, software release cycles, and

compensating controls.
- Assess vulnerabilities across cloud environments and large-scale enterprise infrastructure,

including public-facing and internal assets.
- Maintain accurate documentation and provide evidence to support risk decisions, audit

requirements, and compliance reviews.

Required Skills and Qualifications

- 4–5+ years of experience in Vulnerability Assessment and Penetration Testing (VAPT),

Vulnerability Management (VM), or a related cybersecurity role.
- Robust hands-on experience with end-to-end vulnerability management workflows, from

vulnerability discovery and validation through prioritization, remediation tracking, and closure.
- Practical expertise in CVE analysis, CPE matching, CVSS scoring, vulnerability validation, and

risk-based prioritization.
- Ability to interpret security advisories, exploit write-ups, PoC code, and threat intelligence

reports.
- Experience evaluating exploitability,



exposure, business impact, and remediation urgency.
- Working knowledge of enterprise infrastructure and technologies such as Microsoft Windows,

VMware, Oracle/Java, Citrix, F5, and Linux/open-source platforms.
- Experience with vulnerability scanners such as Qualys VMDR, Tenable Nessus, or Rapid7

InsightVM.
- Understanding of patch management, security hardening, remediation SLAs, and vulnerability

lifecycle management.
- Exposure to cloud infrastructure and large-scale enterprise environments.
- Strong technical writing, analytical thinking, stakeholder communication, and documentation

skills.
- Ability to manage competing priorities, support time-sensitive escalations, and work effectively

in an operational environment.

Preferred Qualifications

- Relevant certifications such as CEH, OSCP, CompTIA Security+, CISSP, or vulnerability

management-related certifications.
- Experience in banking, financial services, or other highly regulated enterprise environments.
- Familiarity with MITRE ATT&CK;, CISA Known Exploited Vulnerabilities (KEV), EPSS, and threat

intelligence sources.
- Understanding of IT risk management, security governance, audit requirements, and regulatory

compliance.
- Experience working in global security operations or follow-the-sun support models.

Candidate Profile We are looking for a technically strong cybersecurity professional who can go beyond scanner generated findings, independently evaluate vulnerability risk, make evidence-based prioritization decisions, and communicate actionable remediation guidance to technical and business stakeholders.

Pay: ₹679,000.00 - ₹1,260,000.00 per year

Work Location: In person

📌 Technical Specialist (Bengaluru)
🏢 Astrica Technologies
📍 Bengaluru