Description
We're building a Vulnerability Operations Center from the ground up and need a senior practitioner to lead it. You'll own the full vulnerability management lifecycle - from detection through triage to remediation tracking and reporting - across Nebius' cloud infrastructure, product and hardware stack.
Responsibilities:
- Improve and maintain automated vulnerability triaging capabilities and vulnerability data quality
- Hands-on validation and triaging of most critical/zero-days vulnerabilities
- Work closely with vulnerability data consumers and stakeholders across the organization to meet engineering, compliance, and regulatory requirements
- Contribute to the development of internal platforms, including the Unified Vulnerability Management (UVM) system and the security orchestration platform
- Identify current deficiencies in patch management, drive and oversee improvements across engineering teams and business units
- Own vulnerability intake from all sources
- Prioritize findings using risk-based frameworks and reduce false positive noise
- Drive remediation accountability across infrastructure, platform, and product engineering teams
- Identify, track and report vulnerability management metrics
- Coordinate response to critical/zero-day vulnerabilities
- Define and maintain integration between VOC tooling and the broader security ecosystem
Requirements:
- 5–8 years in information security with at least 3 years focused on vulnerability management or security operations
- Deep familiarity with vulnerability scanning tools and their strengths/limitations in cloud-native environments
- Strong grasp of CVE/NVD, CVSS scoring, EPSS, SSVC and how to apply them to real-world prioritization
- Experience managing vulnerabilities across IaaS/cloud infrastructure
- Experience with GPU/HPC environments is a plus
- Deep understanding of vulnerability sources limitations and corner cases for different vulnerability classes
- Able to write and review code (ability or willingness to develop in Golang)
- Strong grasp of common vulnerability classes at the code and infrastructure level
- Comfortable feeding well-documented vulnerability patterns into AI-assisted code review workflows and critically evaluating the output
- Track record of working cross-functionally with engineering teams and holding stakeholders accountable to timelines
- Strong written and verbal communication
Nice to Have:
- Experience building vulnerability management program from scratch
- Familiarity with container and Kubernetes security
- Experience with supply chain security
- Bug bounty triage experience
- Public talks or research articles
Benefits & Perks:
- Competitive compensation
- Career growth and learning opportunities
- Flexibility and ownership
- Collaborative and innovative culture
- Opportunity to work on impactful AI projects
- International environment and talented teams