Manager - VAPT Patching

Key Responsibilities:

• - Vulnerability & Patch Lifecycle: Lead end-to-end patching, risk-based prioritization, and remediation across servers, endpoints, web and mobile applications, networks, DC/DR and lower environments and APIs.
• - Strategic Planning: Develop the enterprise-wide vulnerability and patch management framework, aligning it with business goals and regulatory standards like ISO 27001, NIST, and PCI DSS.
• - Operational Execution:
1. - Scanning: Direct regular authenticated and unauthenticated scans using tools like Qualys, Tenable, or Rapid7.
2. - Patching: Execute standard and emergency (out-of-band) patch deployments using automation platforms such as SCCM/MECM, Intune, or Tanium.
• - Remediation Validation: Perform post-patching verification scans and manual re-testing to confirm that vulnerabilities are successfully closed and no new issues (regressions) were introduced.
• - Change & Risk Management: Manage patch testing in non-production environments and coordinate maintenance windows with system owners to minimize downtime.
• - Reporting & Governance: Maintain real-time dashboards to track Patch Compliance Rate and Mean Time to Remediate (MTTR), providing executive summaries to senior leadership.
• - Team Leadership: Lead, mentor, and guide a team of security analysts, conducting knowledge sharing sessions to stay ahead of emerging threats.
• - Stakeholder Liaison: Act as the primary point of contact for senior management and CTO, translating technical findings into actionable business risk reports.

Additional Requirements:

• - Windows Server, Linux (RHEL/CentOS), VMWare, Nutanix, OCP
• - Understanding of exploit techniques (e.g., lateral movement, privilege escalation) to better prioritize critical patches.
• - Understanding of SAST/DAST, manual exploitation, and configuration reviews.
• - Preferred credentials include- OSCP, CEH, or GPEN.
• - Management: CISSP, CISM, or CRISC.

Soft Skills:

• - Communication: Ability to explain complex vulnerabilities to non-technical business leaders.
• - Analytical Thinking: Strong problem-solving skills for identifying root causes of security failures.
• - Vendor Management: Experience managing SLAs and deliverables for external security testing firm.

Key Performance Indicators (KPIs):

• - Patching SLA Compliance: Percentage of critical vulnerabilities patched within the organizations defined timeline (e.g., 48 hours for critical threats).
• - Patching & Scan Coverage: Proportion of corporate assets (including across servers, endpoints, web and mobile applications, networks, DC/DR and lower environments and APIs) actively monitored and patched for vulnerabilities.
• - Remediation Efficacy: Percentage of vulnerabilities that reappear in subsequent scans after being marked as "fixed".