Vulnerability Intelligence Analyst

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Lead Vulnerability Intelligence Analyst based in Spain.

• Lead the technical direction of the vulnerability intelligence practice, establishing rigorous standards for vulnerability validation, assessment, and communication.
• Research newly disclosed vulnerabilities and determine whether reported exploitation claims are technically valid and relevant to real-world environments.
• Acquire, modify, test, and validate proof-of-concept exploits in controlled virtual environments to confirm or refute exploitability claims.
• Design, build, and operate honeypots and sensor systems capable of monitoring real-world exploitation activity.
• Develop practical mitigation strategies for situations where patching is delayed, unavailable, or insufficient, including configuration hardening, network segmentation, access controls, feature disabling, and other defensive measures.
• Develop techniques for identifying both attempted and successful exploitation, including the artifacts and indicators defenders should monitor and hunt for.
• Produce detailed vulnerability intelligence reports explaining how exploits work, who is using them, who is being targeted, and what actions defenders should take.
• Build and maintain automation that streamlines vulnerability assessment, PoC testing, triage, intelligence collection, and analysis workflows.
• Identify and evaluate new sources of vulnerability intelligence and integrate valuable sources into the intelligence lifecycle from ingestion through enrichment and delivery.
• Train, mentor, and support junior team members, raising the technical capabilities and analytical standards of the wider team.
• Contribute to continuous improvements in vulnerability research methodologies, tooling, detection approaches, and intelligence coverage.

• Demonstrated subject-matter-expert-level knowledge of vulnerability research and intelligence, with substantial experience analyzing and validating vulnerabilities in production or research environments.
• Proven ability to validate and test proof-of-concept exploits and independently assess whether exploitation claims are technically credible.
• Strong programming ability in at least one language such as Python, Go, C, C++, or a similar language, sufficient to understand exploit code, modify PoCs, and develop custom tooling.
• Hands-on experience working with virtual machines, containers, and reusable laboratory environments for safe exploitation testing and technical analysis.
• Strong computer science fundamentals and a thorough understanding of core computing and internet technologies, including TCP/IP, HTTP, DNS, TLS, authentication, authorization, and real-world system deployment.
• Ability to develop mitigations beyond simply recommending patches and understand how defensive controls affect exploitation risk.
• Experience developing methods to detect attempted and successful exploitation and translating technical findings into actionable defensive guidance.
• Strong technical writing skills, with the ability to produce clear and detailed vulnerability intelligence reports for security professionals.
• A strong bias toward automation and demonstrated ability to build systems that make vulnerability assessment, triage, and analysis more efficient.
• Experience mentoring or training less experienced security professionals and raising technical standards across a team.
• Ability to identify new vulnerability intelligence sources and evaluate their reliability, relevance, and potential value.
• Experience building honeypots or sensor systems to monitor real-world exploitation activity is highly desirable.
• Experience automating proof-of-concept testing and validation is a strong advantage.
• Experience integrating intelligence sources end-to-end, including evaluation, ingestion, normalization, enrichment, and delivery.
• Additional valuable experience includes original vulnerability research or CVE credits, reverse engineering, detection engineering with Sigma, Snort/Suricata, or YARA, SOC operations, and familiarity with CVSS, CWE, EPSS, and the KEV catalog.
• Public speaking, conference participation, or published technical security writing is also advantageous.

• Competitive compensation: Market-competitive compensation based on experience and expertise.
• Remote-friendly culture: Work remotely while collaborating with an experienced international cybersecurity team.
• Wellness programs: Access programs designed to support employee health and wellbeing.
• Professional development: A variety of opportunities to expand your technical knowledge, cybersecurity expertise, and career development.
• Technical impact: Work directly on high-priority vulnerability intelligence challenges and help organizations better understand and defend against emerging threats.
• Experienced environment: Collaborate with experienced professionals dedicated to staying ahead of evolving threats.