Security Consultant (Vulnerability Management and Triage) - Freelance

Context

Within Group Digital & IT, the VOC team is responsible for continuously monitoring vulnerabilities across Saint-Gobain's environment and driving remediation activities through effective qualification, prioritization, and governance processes.

As a VOC Consultant, you will play a key role in leading and coordinating activities related to Vulnerability Triage, Vulnerability Management, and Security Analytics. Reporting to the VOC Manager, you will contribute to improving vulnerability data quality, remediation governance, and automation capabilities across the Group.

Missions

• Lead and manage daily Triage team activities.
• Drive the objective of reviewing and qualifying all High, Critical, and Highly Critical vulnerabilities across all sources.
• Support remediation governance by coordinating with Asset Managers and remediation teams.
• Define and improve vulnerability qualification, prioritization, and tracking processes.
• Produce operational KPIs and reporting to monitor remediation performance.
• Analyze discrepancies between Qualys, Security Analytics dashboards, and reporting repositories.
• Challenge and refine vulnerability severity and risk scoring using available intelligence and business context.
• Validate findings accuracy and improve vulnerability data quality.
• Support the continuous enhancement of reporting and vulnerability analytics.
• Define and implement audit processes for False Positive requests submitted via CyberIC.
• Maintain and improve ETL pipelines, workflows, and automation scripts.
• Identify opportunities for automation to improve triage efficiency and remediation tracking.
• Support Vulnerability Management teams in assessing, validating, and challenging outputs from Qualys, Patrowl, Oeil Scanner, and other vulnerability sources.
• Enhance Vulnerability Management capabilities.
• Provide operational support and enablement.
• Lead the VM & Triage team.

Tools & Environment

• Qualys
• Patrowl
• Oeil Scanner
• CyberIC
• ETL pipelines and automation scripts
• Security Analytics dashboards

Working Conditions

Not specified.