Vulnerability Response Senior SME

Our requirements

• Minimum 5 years of experience in IT Security or a similar role
• Proven experience reviewing and assessing critical/high-severity vulnerabilities from sources such as NIST/NVD and vendor advisories, translating findings into clear business impact
• Strong understanding of common vulnerability types and attack techniques (e.g., remote code execution, privilege escalation, authentication bypass)
• Experience with vulnerability scanning tools, including Tenable, and application security testing (SAST, DAST)
• Solid technical foundation across networking and application delivery, including WAFs, load balancers, and TLS/certificates
• Experience working across on-prem and cloud environments
• Practical knowledge of remediation approaches: patching, upgrades, configuration hardening, and compensating controls
• Strong stakeholder management skills – able to partner with service owners, platform teams, and governance stakeholders to drive actions to closure
• Excellent written communication skills

Optional

• Good understanding of the CI/CD lifecycle and how security testing integrates into build and release pipelines
• Background in Cyber Security Operations, Risk Management, or Governance within a mid-to-large enterprise

Your responsibilities

• Assess and Review Vulnerabilities: Analyze critical and high-severity vulnerabilities (NIST/NVD, vendor advisories), determine exposure and impact on our environment.
• Validate and Map Risks: Confirm findings, validate exposure, and map vulnerabilities to assets through CMDB and inventory collaboration.
• Define Mitigation Strategies: Recommend remediation and mitigation approaches such as patching, upgrades, hardening, and compensating controls.
• Drive Execution & Governance: Coordinate remediation progress, ensure timely delivery, and provide high-quality technical and governance reports.
• Verify Effectiveness: Oversee validation testing and confirm closure of remediation activities.
• Regulatory & Audit Support: Provide data and commentary for regulatory, audit, and governance reporting (Risk Maps, KCIs, KRIs).
• Note: Detailed project information will be shared during the recruitment process.

About the project

This is how we work on a project

• Continuous Deployment
• Continuous Integration
• DevOps
• issue tracking tools
• testing environments

What we offer

• Flexible cooperation model – choose the form that suits you best (B2B, employment contract, etc.).
• Hybrid work setup – Hybrid: 6x/msc from the office in Kraków
• Collaborative team culture – work alongside experienced professionals eager to share knowledge.
• Continuous development – access to training platforms and growth opportunities.
• Comprehensive benefits – including Interpolska Health Care, Multisport card, Warta Insurance, and more.
• High quality equipment – laptop and essential software provided.

Benefits

• sharing the costs of sports activities
• private medical care
• sharing the costs of professional training & courses
• life insurance

Mindbox Sp. z o.o.