Security Controls Engineer - Vulnerability management
Gen Digital6 months ago
Prague, CzechiaMid Level / Senior
Responsibilities
- Design, operationalize, and continuously improve vulnerability management and remediation programs.
- Manage vulnerability identification, triage, prioritization, remediation, validation, and reporting.
- Translate policy, legal, regulatory, and security control requirements into user stories, acceptance criteria, remediation tasks, and runbooks.
- Support coordinated disclosure, SBOM transparency, patch management, secure development practices, and post-deployment monitoring.
- Track, report, and escalate progress, risks, dependencies, vulnerability ageing, patch latency, and systemic root causes.
- Collaborate across Security and DevOps teams and facilitate stakeholder alignment.
Requirements
- Typically 3–5 years of experience in vulnerability management, security engineering, or security program delivery in a cloud/software environment.
- Experience independently driving outcomes across multiple teams.
- Working understanding and implementation experience with frameworks or regulations such as ISO 27001, NIS2, SOC 2, GDPR, and PCI DSS.
- Hands-on experience with work tracking tools such as Jira or Azure DevOps and with creating leadership status reports and dashboards.
- Understanding of modern SDLC and DevOps practices, including CI/CD, infrastructure as code, pipelines, and change management.
- Experience working in AWS, Azure, or GCP environments, including shared responsibility and guardrail patterns.
- Strong communication, analysis, writing, meeting facilitation, and stakeholder alignment skills.
- A wry sense of humor is a plus.
Benefits
- Flexible working options, generous time off, competitive pay, benefits, and well-being programs.
- Work in a diverse and inclusive environment with opportunities for career growth, experimentation, and continuous learning.
- Two-stage interview process consisting of interviews with the hiring manager and the hiring manager’s manager.
Tech Stack
Categories
About Gen Digital
Gen Digital is a public consumer cyber safety company that sells subscription software and services for cybersecurity, online privacy, and identity protection under brands including Norton, Avast, LifeLock, Avira, AVG, CCleaner, and ReputationDefender. Formed in 2022 by the merger of NortonLifeLock and Avast, it is headquartered in Tempe, Arizona, and serves more than 150 countries with a user base approaching 500 million. Revenue comes primarily from direct-to-consumer subscriptions and partnerships.