Analyst: Cybersecurity, Vulnerability Operations Center (VOC)

Key Job Responsibilities: VOC - VI (Vulnerability Intelligence) & ASM (Attack Surface Management) Analyst

Environment / Context

Saint Gobain, world leader in the habitat and construction market, is one of the top 100 global industrial groups.  Saint-Gobain is present in 68 countries with 171 000 employees. They design, manufacture and distribute materials and solutions which are key ingredients in the wellbeing of each of us and the future of all. They can be found everywhere in our living places and our daily life: in buildings, transportation, infrastructure and in many industrial applications. They provide comfort, performance and safety while addressing the challenges of sustainable construction, resource efficiency and climate change.

Saint-Gobain GDI Groupe (250 persons at the head office, including 120 that are internal) is responsible for defining, setting up and managing the Group's Information Systems (IS) and Telecom policy with its 1,000 subsidiaries in 6,500 sites worldwide. The GDI Groupe also carries the common means (infrastructures, telecoms, digital platforms, cross-functional applications).

INDEC, the IT Development Centre of Saint-Gobain, is an entity with a vision to leverage India’s technical skills in the Information Technology domain to provide timely, high-quality and cost-effective IT solutions to Saint-Gobain businesses globally.

Within the Cybersecurity Department, the Cybersecurity Vulnerability Operations Center mission is to Identify, assess and confirm vulnerability and threats that can affect the Group. The CyberVOC teams are based out of Paris and Mumbai and consist of skilled persons working in different Service Lines.

Mission

The VOC VI & ASM Analyst will be part of a team responsible for monitoring and identifying vulnerabilities as well as proactively assessing their threat with regards to Saint-Gobain context. The team also provides comprehensive feedback and guidance on detected vulnerabilities to assist Security Officers and Application Manager on the remediation part.

This role takes a holistic approach to identifying newly published vulnerabilities and contextualizing them to Saint-Gobain environment as well as tracking potential external entry points to Saint-Gobain systems and data.

The VOC VI & ASM Analyst is responsible for:

• Vulnerability Intelligence (VI):
  • Monitor new vulnerabilities and assess their criticality and risk severity based on threat, exploit availability, ease of exploit, impact, …
  • Communicate and publish an assessment on vulnerabilities related to software used in Saint-Gobain’s scope
  • Maintain timely, high-quality vulnerability bulletins, prioritizing issues against the Group’s asset exposure
  • Update on a regular basis our software inventory in the scope of Vulnerability Assessment Service
  • Keep the vulnerability database up to date; enrich each CVE and security bulletin with QDS, EPSS, CVSS metrics, …

• Attack Surface Management (ASM):
  • Operate continuous monitoring of external assets via ASM Security tools
  • Update on a regular basis the coverage of ASM tools, by adding known domains and IP ranges belonging to Saint-Gobain
  • Assess the severity of the findings and confirm their presence (review, challenge, FP assessment, …)
  • Track and report exposure trends; escalate high-risk findings to Blue-Team remediation owners
  • Build and use the external footprint to proactively identify new threats and new vulnerabilities
  • Leverage ASM tools to proactively identify external assets subject to newly published vulnerabilities

• BlackBox Pentesting:
  • Drive proactive follow-up on detected vulnerabilities, engaging system owners and tracking remediation to closure
  • Active follow up with Application managers to onboard new application in the BlackBox Pentesting service
    • Pentest launch
    • Contract follow-up
    • Tools follow up and maintenance

• Vulnerability Management:
  • Vulnerability review, recategorization, and false positive identification
  • Proactive vulnerability testing and replay
  • Pre-analyze and consolidate vulnerability data from various scanning tools
  • Prepare concise syntheses of available vulnerabilities
  • Offer guidance to the SO and CISO on vulnerabilities
  • Collaborate with key stakeholders to develop strategies for vulnerability management

• Scripting and automation:
  • Automate data extraction and data push from VI and ASM tools to DataLake tools
  • Build automation workflows to streamline vulnerability identification, assessment, and reporting
  • Collaborate with the offensive and defensive teams to enhance vulnerability assessment and testing

Skills                                                                                

• Bachelor's degree in Computer Science, Information Security, EXTC or related field; relevant certifications (e.g., CISSP, CCSP, CompTIA Security+) are a plus
• Proven experience (6+ years) working within the Cybersecurity field, with emphasis on security platform implementation & administration
• Experience on Penetration testing actions (web application, infrastructure, …)
• Experience with security scanning tools
• Experience with VI and ASM tools
• Experience in investigating newly published vulnerabilities and assessing their risks and severity
• Experience with scripting languages (e.g., Python, Bash, Powershell, C#, …) for automation and customization of security processes is a plus
• Experience with Pentester tools (Burp, SQLmap, Metasploit, Kali environment, …)
• Strong technical skills with an interest in open-source intelligence investigations
• Knowledge of NIST CVE database, OWASP Top 10, Microsoft security bulletins
• Excellent writing skills in English and ability to communicate complicate technical challenges in a business language to a range of stakeholders.

Personal Skills 

• Has a systematic, disciplined, and analytical approach to problem solving with Thorough leadership skills & experience
• Excellent ability to think critically under pressure
• Strong communication skills to convey technical concepts clearly to both technical and non-technical stakeholders
• Willingness to stay updated with evolving cyber threats, technologies, and industry trends
• Capacity to work collaboratively with cross-functional teams, developers, and management to implement robust security measures

Additional Information

• The position is based in Mumbai (India)