Vulnerability Management Specialist

About the role

Wabtec is hiring a Vulnerability Management Specialist to work onsite in Contagem, MG, within its Product Cybersecurity Vulnerability Management team. The team identifies, assesses, manages and coordinates responses to cybersecurity vulnerabilities affecting Wabtec products, while supporting regulatory compliance and product security resilience. The role works with engineering, product management, cybersecurity, compliance and business stakeholders across a global organization.

Key responsibilities

• Execute vulnerability management and product security response activities across the product portfolio, including triage, disclosure, incident response and compliance.
• Respond to product vulnerability emergency response activities and coordinate reporting for actively exploited vulnerabilities under the EU Cyber Resilience Act and applicable obligations.
• Take part in a documented on-call rotation for continuous incident detection and response.
• Discover, assess and document vulnerabilities reported by external researchers, penetration testing and security scanning tools, then collaborate with engineering teams to triage them using CVSS and determine product risk.
• Monitor remediation, collect evidence and support vulnerability disposition in line with cybersecurity policies.
• Develop and report cybersecurity KPIs and metrics, and administer vulnerability management tools.
• Coordinate vulnerability disclosure and the publication of vulnerability advisories with engineering and business stakeholders.
• Support PSIRT activities such as readiness reviews, tabletop exercises and lessons learned, and drive continuous improvement of the vulnerability management program.

Required profile

• Bachelor's degree in Computer Science, Software Engineering, Cybersecurity or a related field.
• Experience in cybersecurity, including vulnerability management, SDLC and frameworks such as CVSS, CVE and CWE.
• Experience with compliance standards such as NERC-CIP, ISO and NIST.
• Fluent English, verbal and written.

Required skills

• Certifications such as Security+, CySA+ and GCIH; advanced ones are a plus.
• Scripting with Python and PowerShell.
• Ability to handle multiple priorities and respond to complex incidents under pressure.

What we offer

• Medical and dental assistance extended to dependents.
• Private pension plan, profit sharing and meal policy.
• Life insurance, employee assistance program and Headspace app.
• Christmas card or basket, gift for children up to 11, extended maternity leave and language incentive policy.
• Mentorship programs, training platform and Wellhub.