Offensive Security & Vulnerability Management Engineer - Freelance

We are looking for an Offensive Security & Vulnerability Management Engineer for a 6-month full-time assignment. You will run vulnerability management across AWS production environments, lead offensive testing and attack path validation, and set up governance and reporting to the Security Board. You will work closely with operations, cloud and SOC teams to make sure findings are prioritised, fixed and verified.

1. Vulnerability Management & Governance

Scanning & prioritisation

• Configure and schedule Qualys scans.

• Maintain vulnerability records from AWS

Security Hub and other sources.

• Prioritise findings by severity, exploitability, asset criticality and exposure.

Remediation & coordination

• Lead the global vulnerability management steering.

• Coordinate patching and hardening with operations teams.

• Create the first batch of remediation tickets across Prod, Shared, WorkSpaces and other production environments, then track ownership and verified closure.

Asset context & automation

• Fix Jira Assets assignment automation issues.

• Maintain the LeanIX to AWS resource sync so findings and tickets carry accurate asset and business context.

Reporting & governance

• Prepare the first Security Board review.

• Once it is approved, set up the distribution list and a monthly meeting cadence.

• Report on coverage, tickets created, overdue actions, blockers and remediation progress.

2. Offensive Security & Attack Path

Validation Testing

• Coordinate external penetration tests and run targeted internal tests.

• Run red team exercises and purple team validation with SOC analysts.

XM Cyber attack path management

• Lead XM Cyber Phase 3 planning and prioritise critical attack paths.

• Match filtered findings to hardening tickets, and confirm that completed fixes reduce the related attack paths.

• Clean up XM Cyber scenarios and investigate platform issues.

• Review the C1-Pod-To-Business-Asset scenario weekly with the cloud team.

• Clearly label the Azure proof-of-concept tenant and keep its findings separate from existing scenarios.

Threat intelligence

• Monitor the attack surface.

• Use energy-sector threat intelligence to guide testing and remediation priorities