Vulnerability & Incident Response Analyst

Incident & Regulatory Reporting Coordination

• Support coordination of security incident and exploited vulnerability reporting activities in accordance with applicable regulatory obligations.
• Prepare and maintain the information required for regulatory notifications, working closely with Product Security, Legal, and Product Teams.
• Track incident reporting timelines and ensure escalation activities are completed within defined regulatory timeframes.
• Support incident readiness exercises and reporting process validation activities.

Vulnerability Disclosure & Threat Intelligence Monitoring

• Monitor vulnerability disclosure channels, PSIRT mailboxes, public vulnerability disclosures, security advisories, and relevant threat intelligence feeds.
• Identify vulnerabilities and emerging threats that may impact HBK products and coordinate investigations with relevant stakeholders.
• Track Known Exploited Vulnerabilities (KEVs), industry alerts, and security advisories relevant to HBK products and technologies.
• Maintain awareness of evolving cybersecurity threats, attacker techniques, and regulatory developments.
• Prior experience of Bug bounty portals will be an added advantage.

Remediation Coordination & Tracking

• Coordinate remediation activities with Product Teams, Dev Secops, and Product Security stakeholders.
• Track vulnerability remediation progress against defined remediation targets and service level objectives.
• Support review of proposed security updates, patches, and mitigation plans.
• Produce vulnerability status reports, metrics, and management updates to support governance forums and programme tracking.

Cross-Functional Collaboration

• Serve as the operational liaison between Product Security, Dev SecOps, Customer Support, Legal, and Product Teams.
• Facilitate communication and issue resolution across stakeholders involved in vulnerability management and incident response activities.
• Support the implementation and continual improvement of vulnerability management and coordinated vulnerability disclosure processes.
• Contribute to regulatory readiness initiatives associated with the EU Cyber Resilience Act and related cybersecurity requirements.

Qualifications

Education

• Bachelor’s or master’s degree in cyber security, Computer Science, Information Security, Software Engineering, or a related technical discipline.

Required Experience & Skills

• Experience in vulnerability management, security operations, incident response, PSIRT, application security, or a related cybersecurity discipline.
• Understanding of vulnerability assessment methodologies, CVSS scoring, exploitability analysis, and remediation workflows.
• Familiarity with vulnerability management platforms, ticketing systems, and security scanning tools.
• Knowledge of common vulnerability databases and threat intelligence sources (e.g., CVE, NVD, KEV).
• Understanding of software development lifecycles and secure development practices.
• Familiarity with cybersecurity regulations and standards such as EU CRA, ISO/IEC 30111, ISO/IEC 29147, IEC 62443, NIST SP 800 series, or ISO 27001.
• Strong analytical and problem-solving skills with the ability to prioritise and manage multiple activities simultaneously.
• Excellent stakeholder management and communication skills, with the ability to work effectively across technical and non-technical teams.
• Experience preparing security reports, metrics, and compliance evidence is desirable.

Preferred Experience

• Experience working within a Product Security Incident Response Team (PSIRT).
• Exposure to regulatory reporting obligations and coordinated vulnerability disclosure programmes.
• Experience with vulnerability management automation, DevSecOps pipelines (SAST, DAST integration), SBOM tooling, or software composition analysis platforms.
• Familiarity with cloud, desktop, SaaS, embedded, or industrial control system products.
• Knowhow on Penetration testing