Consultant, Vulnerability Management (ServiceNow)

***Note: We highly appreciate your interest in this position at HCLTech Vietnam. After reviewing all applications, only qualified candidates will be contacted for the next steps within 15 days from the date of submission!!!

ABOUT HCLTECH VIETNAM COMPANY LIMITED

HCL Vietnam Company Limited belongs to HCLTech, a global technology company, home to 220,000+ people across 60 countries, delivering industry-leading capabilities centered around digital, engineering and cloud, powered by a broad portfolio of technology services and products.

We work with clients across all major verticals, providing industry solutions for Financial Services, Manufacturing, Life Sciences and Healthcare, Technology and Services, Telecom and Media, Retail and CPG, and Public Services.

Consolidated revenues as of 12 months ending Mar 31, 2025, totaled $13.8 billion.

Website: https://www.hcltech.com/

JOB TITLE:

Consultant, Vulnerability & Exposure Management

JOB LOCATION:

Ho Chi Minh City, Vietnam (Hybrid working mode)

JOB SUMMARY:

We are seeking an experienced Consultant, Vulnerability & Exposure Management to join our Cyber Security team.

The successful candidate will be responsible for driving vulnerability remediation across assigned technology portfolios by analysing and prioritising security findings, establishing remediation plans, engaging accountable technology teams, and tracking remediation activities through to closure.

The role will support the reduction of overdue vulnerabilities, security exposures and non-compliances across infrastructure, cloud, applications, containers and end-user environments. You will provide practical remediation guidance, ensure accurate vulnerability and governance reporting, escalate delivery barriers, and contribute to AI, automation and process improvements across Vulnerability & Exposure Management.

JOB RESPONSIBILITIES

1. Own assigned vulnerability portfolios and drive security findings through triage, assignment, remediation and closure.
2. Analyse and prioritise vulnerabilities based on severity, exploitability, exposure, asset criticality, business impact and applicable risk criteria.
3. Work closely with application, infrastructure, cloud, service and asset owners to agree on remediation actions, accountable owners, milestones and target completion dates.
4. Track vulnerability remediation progress, follow up on missed commitments, and escalate material risks or delivery barriers through the appropriate governance process.
5. Support remediation campaigns covering Critical, High, overdue, externally exposed and systemic vulnerabilities.
6. Investigate unassigned vulnerabilities, ownership issues, duplicate findings, asset mismatches and remediation status inconsistencies.
7. Review remediation evidence, false-positive requests, vulnerability deferrals and risk exceptions against established requirements and policies.
8. Provide practical remediation guidance to technology teams and support vulnerability consultations and governance forums.
9. Maintain accurate vulnerability records, remediation plans, governance evidence and progress updates in approved systems of record.
10. Manage and support vulnerability remediation workflows using ServiceNow Vulnerability Response or equivalent vulnerability management platforms.
11. Produce accurate and timely operational and management reporting covering vulnerability exposure, remediation progress, SLA performance and overdue backlog.
12. Identify recurring vulnerability findings and systemic root causes and support technology teams in implementing sustainable corrective actions.
13. Contribute to AI, automation, scripting and workflow improvements across vulnerability assignment, triage, communications, data quality, remediation tracking and reporting.
14. Validate automated outputs and ensure exceptions or data-quality issues are appropriately investigated and handled.
15. Ensure vulnerability management activities meet relevant security policies, risk, control, audit and compliance requirements.
16. Support urgent vulnerability remediation and cyber security response activities as required.
17. Stay current with emerging vulnerabilities, threats, exploitation techniques and industry remediation practices.

EXPERIENCE & QUALIFICATIONS

Must-have:

1. Strong professional experience in Vulnerability Management, Cyber Security, Security Operations, Technology Risk, Exposure Management or Vulnerability Remediation Governance.
2. Hands-on experience analysing vulnerability data and driving remediation activities with application, infrastructure, cloud and other technology stakeholders.
3. Strong knowledge of the vulnerability management lifecycle, including identification, triage, prioritisation, assignment, remediation, validation and closure.
4. Ability to assess and prioritise vulnerabilities based on factors such as severity, exploitability, external exposure, asset criticality and business impact.
5. Practical understanding of security vulnerabilities across infrastructure, cloud, applications, containers and end-user environments.
6. Experience managing vulnerability remediation plans, owners, milestones, SLAs, overdue findings, exceptions and risk acceptance processes.
7. Experience with ServiceNow Vulnerability Response or similar vulnerability management/remediation workflow platforms.
8. Strong knowledge of risk, control, governance and compliance principles within a cyber security environment.
9. Strong data analysis and reporting skills, with the ability to identify trends, data-quality issues, recurring vulnerabilities and systemic remediation challenges.
10. Excellent stakeholder management and communication skills, with the ability to engage technology teams, communicate security risks and drive remediation commitments.
11. Ability to independently manage assigned portfolios and deliver outcomes with limited supervision.
12. Strong problem-solving skills with the ability to manage multiple concurrent remediation activities and priorities.
13. Excellent written and verbal English communication skills.
14. Bachelor's degree in Cyber Security, Information Technology, Computer Science or a related discipline, or equivalent relevant professional experience.

Nice-to-have:

1. Experience working within large enterprise or banking/financial services environments.
2. Hands-on experience with vulnerability management/scanning platforms such as Tenable, Qualys, Rapid7 or equivalent technologies.
3. Strong understanding of AWS, Azure, cloud security and cloud vulnerability management.
4. Experience with ServiceNow Vulnerability Response workflow configuration, reporting or operational management.
5. Experience with scripting or automation using technologies such as Python, PowerShell, SQL or APIs.
6. Experience applying AI or automation to vulnerability triage, assignment, communications, data quality or security reporting.
7. Understanding of exposure management, attack surface management and risk-based vulnerability management concepts.
8. Relevant industry certifications such as CISSP, CISM, Security+, CEH, GIAC or cloud security certifications are desirable.

BENEFITS

1. Insurance plan based on full salary + 13th month salary
2. 100% full salary from the 1st day of working and during WFH
3. Medical Benefit (Bao Viet Insurance package) for Employee and Family
4. Working in a fast paced, flexible, and multinational working environment. Chance to travel onsite (in 54 countries)
5. Internal Training (Technical & Functional). Scope of English Training
6. 18 paid leaves per year (including 12 annual leaves + 6 personal leaves)