Position Summary

Assistant Manager, Cyber Engineering– Vulnerability Management & Compliance - Hyderabad

Work you'll do

Responsibilities

As a key member of the Deloitte Member firms team, you will lead the organization's vulnerability management, exposure management, security hygiene, and technical risk reduction programs. You will be responsible for evolving vulnerability management from a traditional CVE-driven process to a risk-based, intelligence-driven capability that continuously assesses the organization's exposure across cloud, AI, applications, infrastructure, endpoints, identities, and third-party technologies.

You will partner closely with application, infrastructure, cloud, identity, endpoint, and security engineering teams to identify, prioritize, communicate, and remediate security weaknesses while driving measurable improvements in enterprise security posture.

This role requires a blend of technical depth, vulnerability intelligence expertise, leadership, stakeholder management, and strategic thinking. The successful candidate must be capable of translating complex technical vulnerabilities into actionable business risk, while helping engineering teams understand what is vulnerable, why it matters, how it can be exploited, and what remediation actions provide the greatest reduction in risk.

Key Responsibilities

Vulnerability & Exposure Management Leadership

- Lead the enterprise vulnerability management program across cloud, infrastructure, applications, containers, AI platforms, endpoints, identities, and third-party technologies.
- Establish and evolve risk-based vulnerability management processes that prioritize exploitability, exposure, attack paths, and business impact rather than relying solely on CVSS scores.
- Develop vulnerability prioritization methodologies incorporating threat intelligence, asset criticality, internet exposure, runtime context, compensating controls, and operational impact.
- Drive remediation programs across multiple technology domains and organizational teams.
- Build and maintain executive-level vulnerability posture reporting, risk dashboards, remediation trends, and exposure scorecards.

Technical Risk Assessment & Prioritization

- Assess newly disclosed vulnerabilities and determine organizational relevance through technology-layer analysis, exploitability validation, runtime context, architecture review, and business impact assessment.
- Analyze vulnerabilities affecting application code, packages and libraries, frameworks, runtimes, application servers, web servers, operating systems, kernels, cloud platforms, containers, AI ecosystems, and infrastructure services.
- Differentiate between inventory findings, runtime findings, exploitable exposure, and confirmed attack paths.
- Perform technical reviews of critical vulnerabilities and guide remediation teams on appropriate response strategies.
- Evaluate emerging attack techniques, exploitation trends, and vulnerability intelligence from vendors, government agencies, security communities, and threat research organizations.

Security Hygiene & Compliance Metrics

- Own and develop enterprise security posture metrics and operational security compliance reporting.
- Establish controls and metrics for:
- Asset hygiene
- Password compliance and credential management
- Workstation and server baseline compliance
- Endpoint health and hardening
- Secure configuration management
- Patch compliance
- Privileged access hygiene
- Vulnerability remediation SLAs
- Cloud security posture compliance
- AI security posture and governance metrics

- Drive accountability across technology teams through measurable compliance objectives and remediation tracking.





Vulnerability Platform & Tooling Ownership

- Lead administration, optimization, integration, and governance of vulnerability and exposure management platforms including:
- Qualys
- Microsoft Defender Vulnerability Management
- Container and cloud security platforms
- Attack surface management solutions
- Threat intelligence integrations

- Improve visibility and correlation across cloud, endpoint, application, infrastructure, and identity security tools.
- Develop automation and integrations to improve vulnerability identification, triage, validation, reporting, and remediation workflows.

Stakeholder Management & Risk Communication

- Serve as the primary vulnerability management advisor for engineering, infrastructure, cloud, application, identity, endpoint, and security teams.
- Lead discussions with application owners, architects, cloud teams, and infrastructure teams regarding vulnerability exposure and remediation strategies.
- Explain technical vulnerabilities in terms of attack paths, business impact, exploitability, and operational risk.
- Present vulnerability posture, remediation progress, compliance results, and risk trends to leadership and technology stakeholders.
- Resolve remediation disputes through technical validation, architecture analysis, and risk assessment.

Team Leadership & Program Management

- Lead, mentor, and develop vulnerability management analysts and engineers.
- Establish operational procedures, remediation playbooks, escalation frameworks, and governance processes.
- Coordinate enterprise-wide responses to critical and actively exploited vulnerabilities.
- Manage remediation campaigns involving multiple technology groups and stakeholders.
- Drive continuous improvement initiatives across vulnerability management, security compliance, and security operations.

Research & Strategic Security Initiatives

- Monitor emerging technologies including AI platforms, AI agents, cloud-native architectures, Kubernetes, serverless, SaaS ecosystems, and identity platforms.
- Research and evaluate modern vulnerability and exposure management techniques, attack path analysis, runtime security, and AI-assisted security capabilities.
- Contribute to enterprise security strategy and long-term security posture improvement initiatives.
- Support AI security, cloud security, and application security programs through exposure and risk analysis.

Skills

- Strong expertise in vulnerability management, attack surface management, security operations, cloud security, and technical risk assessment.
- Deep understanding of software architecture and technology stack components including:
- Applications
- Libraries and packages
- Frameworks
- Runtimes
- Application servers
- Web servers
- Operating systems
- Kernels
- Cloud-native services

- Demonstrated ability to assess exploitability beyond CVSS scoring through runtime context, attack paths, exposure analysis, and business impact considerations.
- Experience with Wiz, Microsoft Defender Vulnerability Management, Qualys, Tenable, Rapid7, or similar platforms.
- Strong knowledge of Azure, AWS, and cloud-native architectures.
- Strong understanding of web applications, APIs, identity systems, authentication technologies, containers, Kubernetes, microservices, CI/CD pipelines,



and contemporary development practices.
- Experience with scripting and automation using PowerShell, Python, KQL, REST APIs, or similar technologies.
- Understanding of AI and AI security concepts including copilots, AI agents, LLM ecosystems, AI governance, AI attack vectors, and AI security controls.
- Strong knowledge of threat intelligence, vulnerability intelligence, exploitability assessment, and MITRE ATT&CK.;
- Familiarity with NIST CSF, NIST AI RMF, CIS Controls, OWASP, ISO 27001, and modern security frameworks.
- Excellent analytical, communication, and stakeholder-management capabilities.
- Proven ability to influence technical and non-technical stakeholders across diverse teams.

Education As per the USI DT CA MF pre-defined criteria

Experience:

(As per the USI Deloitte MF pre-defined criteria for AM) years of experience in cybersecurity, vulnerability management, cloud security, security operations, application security, security engineering, or related fields.

Experience leading enterprise-wide remediation programs and influencing multiple technology teams is strongly preferred.

Experience managing analysts and leading technical security initiatives is highly desirable.

Preferred Certifications

- CISSP
- CCSP
- SC-100
- AZ-500
- GSEC
- GPEN
- GIAC Critical Controls Certification (GCCC)
- AWS Security Specialty
- Certified Cloud Security Professional (CCSP)

Our purpose

Deloitte’s purpose is to make an impact that matters for our people, clients, and communities. At Deloitte, purpose is synonymous with how we work every day. It defines who we are. Our purpose comes through in our work with clients that enables impact and value in their organizations, as well as through our own investments, commitments, and actions across areas that help drive positive outcomes for our communities. Our people and culture

Our inclusive culture empowers our people to be who they are, contribute their unique perspectives, and make a difference individually and collectively. It enables us to leverage different ways of thinking, ideas and perspectives, and bring more creativity and innovation to help solve our clients’ most complex challenges. This makes Deloitte one of the most rewarding places to work. Professional development

At Deloitte, professionals have the opportunity to work with some of the best and discover what works best for them. Here, we prioritize professional growth, offering diverse learning and networking opportunities to help accelerate careers and enhance leadership skills. Our state-of-the-art DU: The Leadership Center in India, located in Hyderabad, represents a tangible symbol of our commitment to the holistic growth and development of our people. Explore DU: The Leadership Center in India. Benefits to help you thrive

At Deloitte, we know that great people make a great organization. Our comprehensive rewards program helps us deliver a distinctly Deloitte experience that helps that empowers our professionals to thrive mentally, physically, and financially—and live their purpose. To support our professionals and their loved ones, we offer a broad range of benefits.

Eligibility requirements may be based on role, tenure, type of employment and/ or other criteria. Learn more about what working at Deloitte can mean for you. Recruiting tips

From developing a stand out resume to putting your best foot forward in the interview, we want you to feel prepared and confident as you explore opportunities at Deloitte. Check out recruiting tips from Deloitte recruiters. Requisition code: 373480

Assistant Manager, Cyber Engineering- Vulnerability Management and Compliance-Hyderabad

Hyderabad, Telangana, India

📌 Assistant Manager, Cyber Engineering- Vulnerability Management and Compliance-Hyderabad
🏢 Deloitte
📍 Hyderabad