Overview
Role: Product Security Engineer
Experience: 3+ Years
Location: Noida
Job Description:
Security Specialist in areas of Security Vulnerability Assessment & Penetration Testing. Responsible for periodic assessment and implementation of remediation with the help of node owners.
Job Key Tasks & Responsibilities:
· Experience in developing trailored Vulnerability Assessment Profiles in collaboration with clients, outlining assessment scope, methodologies, risk assessment criteria, and reporting structures.
· Have created and configured custom scan policies for vulnerability scanners, ensuring accurate, tailored scans to meet organizational needs and risk tolerance.
· Configure scan policies for full network scans, application scans, compliance checks, and sensitive data exposure detection.
· Performed both authenticated and unauthenticated scans across telecom networks and cloud environments (VNF, CNF). Troubleshooting and debugging scans.
· Performed automated and manual scans against the CIS Benchmarks (e.g., CIS AWS Foundations, CIS Linux, CIS Windows) to ensure compliance with industry best practices.
· Performed comprehensive risk triage by analyzing vulnerability reports, verifying false positives, and assigning accurate severity levels to vulnerabilities based on CVSS matrix.
· Evaluate the impact of vulnerabilities and prioritize vulnerabilities based on CVSS scoring and considering exploitability in telecom environments (e.g., SS7, Diameter, GTP, VoIP, IoT, 5G).
· Perform cloud-specific vulnerability assessments for containers and orchestration platforms (Docker, Kubernetes).
· Provide remediation recommendations based on scan findings, including patching, work arounds, configuration hardening, and compensating controls.
· Worked on remediation of non-compliant configurations and security issues based on CIS recommendations.
· Experience in threat intelligence gathering to identify known exploits and determine the current exploitation risk of vulnerabilities (e.g., availability of exploit POC, exploit in wild).
· Experience of working in ticketing tools i.e. ServiceNow, Jira.
· Proficiency in Linux, Windows, and cloud security hardening.
· Knowledge security frameworks and standards (e.g., NIST, ISO 27001, CIS)
Experience & Certification:
· Minimum 3+ years of relevant experience in a combination of security and operations technology jobs
· Vulnerability Scanning tools: Nessus, Qualys, OpenVAS
· Cloud Scanning Tools: Redhat ACS, Anchore, Trivy
· Ticketing Systems: Jira, ServiceNow, Remedy Telecom Expertise: Telecom architecture(2G,3G,4G,5G), Nokia Nodes and functionalities