Vulnerability Response Analyst: Exploitability & Risk Assessment- Remote

Position Overview

This role supports a major financial services customer s global cyber organization. You will join the vulnerability response team, which works across North America, Europe, and Asia in a follow-the-sun model. You will assess critical vulnerabilities, work out how they affect the business, and set the risk rating that drives how fast teams remediate. We are looking for analysts who form their own judgment about real-world risk, not people who rely on scanner output or published scores.

Key Responsibilities
Assess newly disclosed critical vulnerabilities from a prioritized queue and determine whether, and how severely, they affect the organization
Review asset and inventory data to identify affected systems, including systems that scanning tools do not cover
Complete impact assessments that combine threat intelligence, exploitability, proof-of-concept feasibility, and the real effectiveness of compensating controls
Model realistic attack paths for widely deployed runtimes, platforms, and open-source components
Set organization-specific severity ratings on top of CVSS, with clear rationale. Ratings are peer reviewed
Work with application owners, infrastructure teams, and security teams to drive timely remediation, and support urgent incident calls when an issue needs immediate action
Read and interpret vendor advisories, exploit code, and published research to judge real-world risk
Write clear, audit-ready case notes that document decisions and priorities
Hand off active cases cleanly to teammates in other regions to keep coverage continuous
Contribute ideas that improve assessment speed and consistency, including responsible use of automation and AI-assisted tools

Required Qualifications
5+ years of hands-on vulnerability management, triage, or risk assessment experience, ideally in financial services or other regulated environments
Strong command of CVE, CPE, and CVSS, including environmental and custom scoring
Ability to judge exploitability beyond tool output and to model how an attacker would use a vulnerability
Working knowledge of common vulnerability classes (memory corruption, deserialization, injection) and how they lead to impact such as remote code execution
Experience interpreting vendor advisories, proof-of-concept code, and third-party research
Familiarity with enterprise platforms such as Microsoft, VMware, Oracle/Java, Citrix, and F5, plus cloud environments and large-scale open-source use
Clear technical writing and communication, and sound judgment when information is incomplete
Ability to contribute quickly in a fast-moving environment with limited ramp-up

Preferred Qualifications
Background in penetration testing, red teaming, vulnerability research, exploit analysis, or threat intelligence
Experience building or validating proofs of concept, or performing static and dynamic analysis
Hands-on experience with AI tools and agentic workflows, with human review of results
Experience with patch and release lifecycles for enterprise software
Relevant certifications such as OSCP, GPEN, GCIH, GXPN, or CISSP