Senior Cybersecurity Analyst - Vulnerability & Exposure Management

About the role

iQVIA is looking for a Senior Cybersecurity Analyst who provides subject matter expertise and oversight of vulnerability management, attack surface management, continuous threat exposure management (CTEM) and penetration testing. The role manages operations from asset discovery and scanning through risk-based prioritization, remediation tracking and closure validation, and reports exposure risk to senior leadership.

Key responsibilities

• Manage the operation of vulnerability management, external attack surface management and CTEM capabilities, from asset discovery and scanning through risk-based prioritization, remediation tracking and closure validation.
• Provide leadership and direction to analysts in the area of responsibility and act as escalation point for complex, contested or zero-day exposures.
• Oversee functional governance: standard operating procedures, remediation SLAs, risk-acceptance and exception workflows, and key performance indicators.
• Control the penetration testing program: define scope and rules of engagement, coordinate internal and third-party testers, review report quality and drive findings through remediation and retest.
• Correlate threat intelligence with internal and external exposure data to prioritize what is exploitable and business-critical.
• Provide regular performance updates and exposure risk reporting to senior leadership.
• Act as subject matter expert on issues requiring detailed knowledge of the area of responsibility.

Required profile

• Bachelor's degree in computer science or a related field, or equivalent experience (equivalent experience preferred).
• 5 years of related work experience, including 3 years in vulnerability or exposure management.
• Fluent English, written and spoken.
• Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM) and Certified in Risk and Information Systems Control (CRISC).

Required skills

• Vulnerability management and risk-based platforms, external attack surface management, CTEM platforms, threat intelligence platforms, cloud security posture management (CSPM/CNAPP), breach and attack simulation or other exposure validation tools, and IT service management and CMDB for remediation workflows.
• Strong knowledge of CVSS, EPSS, known-exploited vulnerability catalogs, MITRE ATT&CK and OWASP Top 10.
• Working knowledge of at least one major public cloud provider, networking, Windows and Linux.
• Preferred: scripting or API automation (Python, PowerShell) and data reporting / BI tools; technical certifications such as GIAC, OSCP, CompTIA PenTest+ or a cloud security certification.