Senior Vulnerability Analyst

Responsibilities

• Perform deep technical analysis of reported vulnerabilities, including root-cause investigation, exploitability assessment, and CVSS/SSVC scoring
• Triage incoming vulnerability reports from internal scanners, SCA tooling, and external researchers
• Analyze source code in C/C++, Java, and web application frameworks to validate findings and assess fixes
• Build and maintain alerting rules and detection automation to identify emerging vulnerabilities
• Hunt for CVEs and CWEs affecting components, third-party dependencies, and container base images
• Track engineering remediation efforts against defined patching SLAs and coordinate fix timelines
• Draft customer-facing Product Security Advisories (PSAs) with high technical accuracy
• Develop and enhance PSIRT tooling, including SCA/SAST integration and SBOM analysis pipelines

Requirements

• 5+ years of experience in vulnerability analysis, product security, application security, or security engineering
• 2+ years of experience operating within a PSIRT, CERT, or comparable vulnerability coordination function
• Proficiency in Linux, container security, and web application security
• Working knowledge of C/C++ and Java for code-level vulnerability assessment
• Hands-on experience with CVE/CWE analysis workflows and vulnerability databases
• Strong written and verbal communication skills for technical documentation and advisory authoring

Preferred Qualifications

• Experience with offensive security techniques, penetration testing, or red team operations
• Hands-on experience with SCA tools (e.g., Black Duck, Snyk, Trivy) and SBOM tooling
• Experience building security automation or detection rules in Python or Go
• Relevant security certifications such as OSCP, GPEN, GWAPT, or CSSLP
• Familiarity with NIST SSDF and Coordinated Vulnerability Disclosure frameworks

About the Company

Qualys, Inc. is a pioneer and leading provider of disruptive cloud-based security, compliance, and IT solutions, serving more than 10,000 subscription customers worldwide, including a majority of the Forbes Global 100 and Fortune 100.