Vulnerability Analyst

About the Role

The Container Security Subject Matter Expert (SME) supports Vulnerability Management across EY by helping manage the full vulnerability lifecycle for containerized environments. This role requires strong practical knowledge of container and Kubernetes security, including hands-on expertise with Aqua Security (AquaSec), as well as experience with Wiz and Kubernetes-as-a-Service (KaaS) environments. The candidate will act as a key technical resource for Container Vulnerability Management, partnering Operations, Engineering, KaaS DevOps, application teams, and other stakeholders to identify, analyze, triage, communicate, track, and support remediation of security vulnerabilities affecting containerized environments. The role combines technical expertise, vulnerability management, stakeholder coordination, metrics and reporting, risk-based prioritization, and continuous service improvement.

Key Responsibilities

• Manage end-to-end vulnerability management activities across the lifecycle for containerized environments, including containers, container images, registries, Kubernetes clusters, and related cloud-native infrastructure.
• Track and report remediation progress, vulnerability aging, SLA adherence, exceptions, and risk acceptance items.
• Use container security tools such as AquaSec and Wiz to assess, monitor, and support remediation of container-related vulnerabilities.
• Serve as the Container Security SME by providing technical guidance and advisory support for vulnerability remediation in containerized environments.
• Identify automation opportunities that improve the efficiency, consistency, and effectiveness of container security operations.
• Analyze vulnerability data to develop metrics that provide actionable vulnerability intelligence and exposure visibility across container environments.
• Engage closely with application, DevSecOps, cloud, and platform engineering teams to drive remediation of vulnerabilities in container images and runtime environments.
• Correlate vulnerability data with asset ownership, image lineage, deployment context, internet exposure, and business criticality to support risk-based prioritization.
• Support executive and operational reporting on container security posture, remediation trends, high-risk vulnerabilities, and open risk items.
• Contribute to process documentation, playbooks, metrics, dashboards, and continuous improvement initiatives for container vulnerability management.

Requirements & Tech Stack

• Hands-on expertise with Aqua Security (AquaSec).
• Experience with Wiz.
• Experience with Kubernetes-as-a-Service (KaaS) environments.
• Strong practical knowledge of container and Kubernetes security.
• Experience with Grafana and KQL (Kusto Query Language) is highly desirable.