Dear Aspirant!
We empower our people to stay resilient and relevant in a constantly changing world. We’re looking for people who are always searching for creative ways to grow and learn. People who want to make a real impact, now and in the future. Does that sound like you? Then it seems like you’d make a great addition to our vibrant international team.
We are looking for: Data Analyst - Vulnerability Management Analyst
You’ll make an impact by:
- Review vulnerability scan results from enterprise vulnerability management tools and identify the assets and systems associated with scan findings using available inventory and ownership records.
- Analyze and document findings using available severity scores, exploitability information, asset data, exposure information, and established prioritization criteria.
- Apply organization-defined risk categories and remediation SLAs; flag missing or conflicting inputs and refer business-impact or risk determinations to the designated onshore/DTS/C&T SME.
- Create, assign, and track remediation tickets with clear technical details, affected assets, severity information, remediation guidance, owners, and due dates.
- Coordinate with infrastructure, application, cloud, network, product, and OT/plant teams to progress remediation activities.
- Track remediation progress, overdue findings, aging, exceptions, dependencies, and recurring vulnerabilities.
- Escalate critical and high-severity findings, aging items, remediation blockers, and cases requiring risk or control decisions to the appropriate stakeholders.
- Document remediation constraints, such as legacy technology, vendor dependencies, operational availability, maintenance windows, or patching limitations, and coordinate evaluation of potential compensating controls with the designated DTS/C&T SME.
- Record compensating-control decisions, approved exceptions, and risk-treatment outcomes as provided by authorized decision-makers; do not independently select controls, approve exceptions, or accept residual risk.
- Coordinate vulnerability rescans and validate closure evidence through scanner results, configuration checks, patch verification, or other approved validation methods.
- Validate that submitted evidence meets the defined operational closure criteria and escalate disputed or technically ambiguous results to the designated SME.
- Produce vulnerability operational reports covering ticket status, remediation SLA compliance, backlog, aging, exceptions, blockers, and closure progress.
- Identify recurring vulnerability patterns and recommend process improvements or preventive actions for review by the responsible technical owners.
- Maintain accurate records and audit trails in vulnerability management and ticketing systems.
- For OT/manufacturing assets, work within established plant change-control processes and escalate PLC, HMI, SCADA/DCS, industrial network, production-architecture, or vendor-qualified firmware decisions to the designated SME.
Use your skills to move the world forward!
- B.E./B.Tech./MCA/M.Sc. in Computer Science, Information Technology, Cybersecurity, Engineering, or a related discipline.
- 6–8 years of experience in vulnerability management, security operations, infrastructure security, or a related cybersecurity domain.
- Experience working with enterprise vulnerability assessment tools and remediation workflows.
- Experience coordinating remediation across multiple technical teams and maintaining accurate operational records.
- Relevant certifications such as Security+, CySA+, CEH, GIAC, or equivalent are preferred.
- Strong understanding of the vulnerability management lifecycle, vulnerability analysis, ticket coordination, remediation tracking, and evidence-based closure.
- Hands-on experience with vulnerability scanners such as Tenable, Qualys, Wiz, Rapid7, or equivalent.
- Good understanding of CVE, CWE, CVSS, exploitability information, remediation guidance, and common vulnerability types.
- Ability to apply documented prioritization rules and remediation SLAs consistently, while escalating business-impact, residual-risk, and control-selection decisions to the responsible SME.
- Working knowledge of Windows and Linux systems, network devices, databases, cloud infrastructure, and enterprise applications.
- Ability to interpret scan results, investigate potential false positives, and document findings for technical-owner review.
- Experience with ticketing and workflow tools such as ServiceNow, Jira, or equivalent.
- Experience supporting OT/ICS or manufacturing environments, including SCADA, substations, utilities, HMI, PLC, RTU, DCS, or industrial control systems, is preferred.
- Awareness of OT-specific constraints such as legacy assets, vendor-managed systems, passive scanning, maintenance windows, and operational availability requirements.
- Knowledge of IEC 62443 and OT/critical-infrastructure security practices is an advantage.
- Basic scripting or automation using Python, PowerShell, Bash, or similar is desirable.
- Strong analytical, documentation, communication, and stakeholder-coordination skills.
Create a better #TomorrowWithUs!
This role is based in Chennai, where you’ll get the chance to work with teams impacting entire cities, countries - and the shape of things to come.
We value your unique identity and perspective and are fully committed to providing equitable opportunities and building a workplace that reflects the diversity of society. Come bring your authentic self and create a better tomorrow with us.
We’re Siemens. A collection of over 312,000 minds building the future, one day at a time in over 200 countries. We're dedicated to equality, and we encourage applications that reflect the diversity of the communities we work in. All employment decisions at Siemens are based on qualifications, merit and business need. Bring your curiosity and imagination and help us shape tomorrow.
Find out more about Siemens careers at:
Find out more about the Digital world of Siemens here: