At a glanceSummarised by Seekless from the posting.
Must have9
Experience in vulnerability management, security operations, incident response, PSIRT, application security, or a related cybersecurity discipline.
Understanding of vulnerability assessment methodologies, CVSS scoring, exploitability analysis, and remediation workflows.
Familiarity with vulnerability management platforms, ticketing systems, and security scanning tools.
Knowledge of common vulnerability databases and threat intelligence sources (e.g., CVE, NVD, KEV).
Understanding of software development lifecycles and secure development practices.
Familiarity with cybersecurity regulations and standards such as EU CRA, ISO/IEC 30111, ISO/IEC 29147, IEC 62443, NIST SP 800 series, or ISO 27001.
Strong analytical and problem-solving skills with the ability to prioritise and manage multiple activities simultaneously.
Excellent stakeholder management and communication skills, with the ability to work effectively across technical and non-technical teams.
Bachelor’s or master’s degree in cyber security, Computer Science, Information Security, Software Engineering, or a related technical discipline.
Nice to have7
Experience preparing security reports, metrics, and compliance evidence is desirable.
Experience working within a Product Security Incident Response Team (PSIRT).
Exposure to regulatory reporting obligations and coordinated vulnerability disclosure programmes.
Experience with vulnerability management automation, DevSecOps pipelines (SAST, DAST integration), SBOM tooling, or software composition analysis platforms.
Familiarity with cloud, desktop, SaaS, embedded, or industrial control system products.
Knowhow on Penetration testing
Prior experience of Bug bounty portals will be an added advantage.
Skills
CVSS
CVE
NVD
KEV
Vulnerability management platforms
Ticketing systems
Security scanning tools
SAST
DAST
SBOM tooling
Software composition analysis platforms
Penetration testing
Bug bounty portals
DevSecOps pipelines
Role Summary
The Vulnerability & Incident Response Analyst will play a key role in supporting HBK’s Product Security function by coordinating product vulnerability management activities, security incident reporting obligations, and cross-functional remediation efforts. The role acts as a central liaison between Product Security, Dev SecOps, and Product Teams to ensure vulnerabilities are effectively assessed, tracked, remediated, and reported in accordance with internal policies and regulatory requirements, including the EU Cyber Resilience Act (CRA).
Key Responsibilities
Vulnerability Triage & Analysis
•
Perform initial triage, validation, and analysis of product vulnerabilities identified through vulnerability disclosures, internal testing, security assessments, penetration testing, or automated scanning tools.
•
Assess vulnerability severity using CVSS, exploitability, product applicability, and business impact criteria.
•
Review vulnerability reports and collaborate with product teams to determine applicability, exploitability, and remediation requirements and help to prioritize the vulnerabilities that need to be addressed considering the Risk.
•
Maintain accurate vulnerability records, evidence, and audit trails to support governance and compliance requirements.
Incident & Regulatory Reporting Coordination
•
Support coordination of security incident and exploited vulnerability reporting activities in accordance with applicable regulatory obligations.
•
Prepare and maintain the information required for regulatory notifications, working closely with Product Security, Legal, and Product Teams.
•
Track incident reporting timelines and ensure escalation activities are completed within defined regulatory timeframes.
•
Support incident readiness exercises and reporting process validation activities.