Cyber VM: Vulnerability Identification (VI)

Job Description

Job Responsibilities:

1. Authenticated vulnerability scanning across all Workstations is sustainably operational (via VPN, Exec, Trader, Desktops, MacOS).
2. Vulnerability information from the mainframe and iSeries is sustainably operationalized into the vulnerability management workflow.
3. Scheduled production scanning of critical internal web applications via unauthenticated DAST capability and is sustainably operational (also authenticated – TBD).
4. All priority fixes to be delivered as defined by the Vendor Vulnerability Scanning Health check.
5. Implement additional fixes as required and prioritized by the Control Owner (or delegate(s))
6. Complete scanning using existing, in house tooling as much as possible, e.g. Nessus, or built-in scanning tools that are native to the platform/asset type
7. Engage with and manage senior GB/GF stakeholders, ITSOs, and SMEs, as needed to accelerate the scanning.
8. Manage the end-to-end scanning process for the in-scope assets, from customer engagement, validation of data sources (inventory), implementation, testing, scanning, troubleshooting, integration with a data repository to house discovered vulnerabilities and integration with the Abstraction Service.
9. Document and update processes, ensuring the process and scanning coverage is aligned to the Vulnerability Management Controls
10. All fixes, outputs, and outcomes to adhere to bank policies, standards, and governance requirements for project delivery.
11. Obtain sign-off from the Control Owner (or delegate(s)) at key checkpoints – to be agreed.
12. Collaborate with other workstream leads to ensure dependencies are managed effectively, duplication of effort is avoided, any cross-work stream impacts are minimized, and delivery is timely and fit for purpose.
13. Complete all outcomes per the acceptance criteria by 30th November 2021

Basic Qualifications:

1. Dev/tester – API & Python (SC).
2. On-prem & tooling (SC).
3. Technical BA (SC).