* Regularly monitor, triage, and prioritize vulnerabilities in third-party dependencies, libraries, and frameworks.
* Analyze security findings from SAST, DAST, and SCA tools (such as SonarQube, Checkmarx, OWASP ZAP, and Dependabot).
* Implement and automate processes for dependency updates, vulnerability detection, and remediation within CI/CD pipelines and container environments (like OpenShift).
* Document vulnerability assessments, remediation activities, and compliance evidence using tools like Jira and vulnerability management platforms.
* Develop and enforce secure coding guidelines, dependency management standards, and best practices.
* Report on vulnerability status, remediation progress, and risk trends to stakeholders and security leadership.
* Support incident response related to critical vulnerabilities, including zero-day exploits and high-severity CVEs.
* Ensure adherence to internal policies and external regulations (such as ISO 27001, NIST, GDPR, and SOC 2).
* Familiarity with cloud security principles (AWS, Azure, GCP) and container security practices.
* Professional certifications such as CISSP, OSCP, CEH, or CCSP.
* Experience with vulnerability management platforms (Tenable, Qualys, Rapid7) and compliance standards.
*

Experience:
Minimum of 3 years of expertise in software security, vulnerability management, or related fields.
* Tools & Technologies:
* Vulnerability detection and management tools (SAST, DAST, SCA such as SonarQube, Checkmarx, OWASP ZAP, and Dependabot).
* Dependency management across multiple ecosystems (npm, Maven, pip, NuGet, or Go modules).
* Container orchestration and security (OpenShift and Docker).
* Version control systems (Git, GitHub) and issue tracking tools (Jira).
* Skills & Knowledge:
* Proficiency in scripting and automation (Python, Bash)



for integrating security processes into CI/CD workflows.
* Deep understanding of vulnerabilities (OWASP Top 10, CWE) and CVSS scoring methodology.
* Experience implementing security best practices within DevOps pipelines and cloud environments.
* Strong analytical and problem-solving skills.
* Familiarity with cloud security principles (AWS, Azure, GCP) and container security practices.
* Professional certifications such as CISSP, OSCP, CEH, or CCSP.
* Experience with vulnerability management platforms (Tenable, Qualys, Rapid7) and compliance standards.

Descripción del puesto
/ Funciones
* Regularly monitor, triage, and prioritize vulnerabilities in third-party dependencies, libraries, and frameworks.
* Analyze security findings from SAST, DAST, and SCA tools (such as SonarQube, Checkmarx, OWASP ZAP, and Dependabot).
* Implement and automate processes for dependency updates, vulnerability detection, and remediation within CI/CD pipelines and container environments (like OpenShift).
* Document vulnerability assessments, remediation activities, and compliance evidence using tools like Jira and vulnerability management platforms.
* Develop and enforce secure coding guidelines, dependency management standards, and best practices.
* Report on vulnerability status, remediation progress, and risk trends to stakeholders and security leadership.
* Support incident response related to critical vulnerabilities,



including zero-day exploits and high-severity CVEs.
* Ensure adherence to internal policies and external regulations (such as ISO 27001, NIST, GDPR, and SOC 2). Requisitos mínimos
* Familiarity with cloud security principles (AWS, Azure, GCP) and container security practices.
* Professional certifications such as CISSP, OSCP, CEH, or CCSP.
* Experience with vulnerability management platforms (Tenable, Qualys, Rapid7) and compliance standards.
*

Experience:
Minimum of 3 years of expertise in software security, vulnerability management, or related fields.
* Tools & Technologies: o Vulnerability detection and management tools (SAST, DAST, SCA such as SonarQube, Checkmarx, OWASP ZAP, and Dependabot). o Dependency management across multiple ecosystems (npm, Maven, pip, NuGet, or Go modules). o Container orchestration and security (OpenShift and Docker). o Version control systems (Git, GitHub) and issue tracking tools (Jira).
* Skills & Knowledge: o Proficiency in scripting and automation (Python, Bash) for integrating security processes into CI/CD workflows. o Deep understanding of vulnerabilities (OWASP Top 10, CWE) and CVSS scoring methodology. o Experience implementing security best practices within DevOps pipelines and cloud environments. o Strong analytical and problem-solving skills. Requisitos valorables
* Familiarity with cloud security principles (AWS, Azure, GCP) and container security practices.
* Professional certifications such as CISSP, OSCP, CEH, or CCSP.
* Experience with vulnerability management platforms (Tenable, Qualys, Rapid7) and compliance standards. Idiomas English is a must Ubicación Barcelona ¿Quiénes somos? Pasiona Consulting es una consultora tecnológica, partner de Microsoft, dedicada al diseño, desa

📌 Vulnerability Management Expert (Barcelona)
🏢 Pasiona Consulting
📍 Barcelona