Vulnerability Analyst

Role: FOSS Sonatype IQ SME

Location: Hyderabad, Pune, Bangalore

Exp:9+

Job Description:

Key Responsibilities:

• Serve as the primary advisor and technical expert for Sonatype Nexus IQ Server and open-source dependency vulnerability scanning.
• Implement and maintain Sonatype IQ integrations within CI/CD pipelines to automate security and compliance checks.
• Analyze and remediate vulnerabilities, license risks, and policy violations in open-source dependencies.
• Develop and enforce software composition analysis (SCA) best practices across development teams.
• Collaborate with security teams to prioritize and mitigate OSS vulnerabilities based on risk assessments.
• Create and maintain custom policy configurations in Sonatype IQ to align with organizational security standards.
• Train and mentor engineering teams on secure OSS usage, dependency management, and DevSecOps best practices.
• Work to uplift the vulnerability scanning and remediation capabilities to meet enhanced Service Level Agreements (SLAs), ensuring timely and effective resolution of security vulnerabilities
• Monitor and report on FOSS risk metrics, providing actionable insights to leadership.
• Stay updated on emerging software supply chain threats and recommend proactive security measures.
• Support SBOM interlock and proactively participate in wider SBOM program.
• To perform security assessment and identify potential risk with open source LLMs.

Required Skills & Qualifications:

• 4+ years of hands-on experience with Sonatype Nexus IQ Server in an enterprise environment.
• Strong understanding of Software Development Life Cycle (SDLC) with a focus on security.
• Strong expertise in open-source Software security, vulnerability management, and license compliance.
• Proficiency in DevSecOps practices, including CI/CD integration (Jenkins, GitLab, GitHub Actions, etc.)
• Experience with software composition analysis (SCA) tools and dependency management (Maven, npm, pip, etc.)
• Knowledge of OWASP Top 10, CVE, and MITRE ATT&CK frameworks related to OSS risks.
• Familiarity with container security (Docker, Kubernetes) and SBOM (Software Bill of Materials) generation.
• Good to have scripting skills (Bash, Python, Groovy) for automation and tool customization.
• Excellent communication skills, with the ability to explain complex security concepts to non-technical stakeholders.
  

Education & Experience:

• 7+ years of experience into cybersecurity, Information security or security engineering.
• Strong DevSecOps and Software security background.
• Desirable to have one or more industry-recognised cybersecurity-related certifications including CISSP, CRISC, CISM, OSCP.
• Bachelor or Masters degree in Computer Science, Information Technology, Cybersecurity or equivalent.