CSIRT Vulnerability Analyst

Statkraft has been making clean energy possible for over a century. Unrivaled pioneering spirit and a strong commitment towards a more sustainable future. That’s what we offer. Today, we are Europe’s largest renewable energy producer and employ more than 6.000 colleagues around the world. Our vision is clear - to renew the way the world is powered. But there is more work to be done and that is why we need you to help us.

The Statkraft CSIRT team is part of the Cyber Security department in Statkraft. Our mission is to avoid or minimize business impact from attempted or conducted cyber-attacks against Statkraft’s assets. We identify and assess security risks and coordinate the response to vulnerabilities and security events.

In a constantly evolving digital landscape, staying ahead of emerging threats is critical. As our new experienced Vulnerability Analyst, you will play an important operational role in protecting our digital assets, infrastructure, and applications. You will join a highly skilled cybersecurity team where your primary focus will be to identify, analyze, validate, prioritize, and follow up vulnerabilities across our technology environment, ensuring that security weaknesses are understood and addressed before they can be exploited.

You will work hands-on with the vulnerability management lifecycle, including vulnerability scanning and assessment, validation of findings, risk-based prioritization, remediation tracking, and reporting. You will analyze technical vulnerabilities and their potential impact, distinguish meaningful security risks from false positives and low-risk findings, and provide clear and actionable remediation guidance to infrastructure, application, cloud, and development teams.

A key part of your role will be to translate technical vulnerability information into practical risk and remediation priorities. You will work closely with system owners and technical teams to ensure vulnerabilities are addressed within defined Service Level Agreements (SLAs), investigate overdue or recurring vulnerabilities, and contribute to improving vulnerability coverage, data quality, and operational processes.

You will also monitor emerging vulnerabilities and threats, including newly disclosed vulnerabilities and vulnerabilities with known or suspected exploitation, and help determine their relevance to our environment. Through continuous analysis, collaboration, and follow-up, you will contribute directly to strengthening our security posture and protecting critical infrastructure across several countries.

Your responsibilities include:

• Performing vulnerability assessments across Statkraft’s digital infrastructure, applications, cloud environments, and assets using commercial and open-source tools.
• Analyzing identified vulnerabilities and combine technical findings, threat intelligence, and business context to assess risk and prioritize remediation.
• Investigating emerging vulnerabilities and threats, assess their potential relevance to Statkraft, and provide actionable recommendations to system owners and technical teams.
• Following up on identified vulnerabilities and working with IT, development, cloud, and system owners to support timely and risk-based remediation.
• Exploring and applying AI to improve vulnerability analysis, prioritization, enrichment, and efficiency, while critically assessing the quality and reliability of AI-generated insights.
• Contributing to the continuous improvement of vulnerability management processes, tools, automation, dashboards, and technical capabilities.
• Supporting security investigations, threat hunting, and security assessments where vulnerability expertise can help identify exposure and reduce cyber risk.

We are looking for passionate colleagues who are excited to make an impact and bring a mix of mindset and skills to the team. This includes:

• Experience in cyber security, vulnerability management, security operations, incident response, or related technical security field.
• Practical experience with vulnerability assessment and scanning tools such as Tenable/Nessus, Microsoft Defender Vulnerability Management, or similar platforms.
• Good understanding of vulnerability lifecycles, common attack techniques, operating systems, networks, cloud technologies, and application security.
• Knowledge within the field of AI, especially frontier AI and related consequences for vulnerability management.
• Strong analytical and critical-thinking skills, with the ability to turn technical findings and data into clear risk assessments and recommendations.
• Scripting or query skills in Python, PowerShell, KQL, Go, Bash, or similar technologies are an advantage.
• Fluency in Norwegian and English, both spoken and written.

We believe the following skills and experiences would be beneficial:  

• Solid networking and communication skills with the ability to easily connect with new people.
• Independent personality able to work well both solo and in various teams spanning across countries, cultures and languages.
• Familiarity with cyber security frameworks such as NIST CSF, NIST SP 800-53, ISO 27001, and/or CIS Controls.
• Experience with Application Security (AppSec), DevSecOps, and SAST/DAST tooling.

We offer

• Unlimited learning opportunities at various levels of the organization 
• The chance to grow your career alongside a truly global network of experts, leaders, specialists, and graduates from different countries and backgrounds 
• The opportunity to work somewhere with pride, and be able to honestly say “My work is contributing to saving the planet” 
• A work culture that puts emphasis on the individual, offering flexible working solutions, and work-life balance principles 
• Statkraft offers competitive terms of employment and benefits schemes, and we’re a trusted employer that puts the safety of our people first. We believe that a safe and healthy working environment is a matter of choice, not chance 

Statkraft manages critical infrastructure and services in several countries. The applicant must be eligible for Norwegian security clearance and authorization. 
 
Statkraft's vision is to renew the way the world is powered. To navigate the complex journey ahead, we need every voice at the table. We therefore work actively to be a diverse and inclusive workplace and welcome all applicants regardless of background, gender, age, sexual orientation, religious belief, ethnicity, nationality or disability.

Application deadline: 14th of November

Location: The position will require physical presence at the main office in Lilleaker, Oslo, Norway.