ppHome » Jobs » Vulnerability Governance Analyst, Italy /ph3Vulnerability Governance Analyst, Italy /h3pWe are a community of visionary innovators, dedicated to providing pioneering software and consultancy services to financial institutions, trading firms, central banks, governments, and corporations around the world.
We strive to simplify the way people work.
We We do that by providing workflow and process automation software, as well as providing real-time data and business intelligence to help people make better decisions.
We are 13,000+ employees, we operate globally with 80+ global offices, and we serve over 4,800+ customers worldwide.
/ppFor the strengthening of the Chief Information Security Office (CISO) function within Cedacri's companies, part of ION Group, we are looking for talented professionals to grow their career as bVulnerability Governance Analyst /b.
This position is targeted at candidates with b2–5 years of relevant experience /b in Cybersecurity, Vulnerability Management, or Information Security Governance.
Selected candidates will be placed in a dynamic and innovative environment and will collaborate with cross-functional teams to strengthen the organization's vulnerability governance framework and security posture.
/pulliSupport the governance and continuous improvement of the enterprise Vulnerability Management program.
/liliMonitor vulnerability remediation activities across infrastructure, cloud, endpoint, and application environments, ensuring compliance with established remediation targets and governance requirements.
/liliPerform risk-based vulnerability analysis considering exploitability, asset criticality, exposure, business impact, and threat intelligence.
/liliCorrelate vulnerability intelligence with CMDB, BIA, SBOM/SCA and application ownership data to identify exposed services,



impacted customers, remediation owners and urgency of action.
/liliPrioritize vulnerabilities using a risk-based model that goes beyond technical severity, considering exploitability, evidence of active exploitation, CISA KEV/EPSS, Internet exposure, asset criticality, client impact and multi-tenant blast radius /liliCoordinate remediation plans and follow-up activities with Infrastructure, Cloud, Development, Application Security, and Risk teams.
/liliManage remediation exceptions, compensating controls, and risk acceptance processes.
/liliDevelop and maintain vulnerability dashboards, KPIs, operational metrics, and executive reports.
/liliSupport the escalation and governance of critical vulnerabilities and high-risk exposure scenarios.
/liliContribute to the definition and continuous improvement of vulnerability management policies, standards, and governance processes.
/liliSupport audits, regulatory assessments, and compliance activities related to cyber risk and vulnerability management.
/li /ulh3Other duties /h3pWe might ask you to perform other tasks and duties as your role expands.
/ph3Your skills, experience, and qualifications required /h3ulliMaster's degree in Cybersecurity, Computer Science, Computer Engineering, Information Technology, or a related field (with honors) /liliAt least 2-5 years of experience in Vulnerability Management, Security Operations, Cyber Risk, Security Governance, or related areas.




/liliUnderstanding of vulnerability lifecycle management, remediation processes, and exposure management practices.
/liliFamiliarity with vulnerability assessment platforms and reporting solutions.
/liliKnowledge of vulnerability prioritization methodologies and industry references such as CVSS, EPSS, CISA KEV, exploit intelligence, and threat intelligence feeds.
/liliFamiliarity with software supply chain security concepts, SBOMs, SCA practices, and DevSecOps environments.
/liliKnowledge of ISO *****, NIST CSF, CIS Controls, DORA, and NIS2 requirements related to vulnerability and ICT risk management.
/liliAbility to communicate technical findings through clear risk-based reporting and executive-level summaries.
/liliStrong analytical, organizational, and stakeholder management skills.
/liliExcellent knowledge of Italian and English.
/liliRelevant certifications such as Security+, CySA+, CISSP, ISO *****, or equivalent would be considered a plus.
/li /ulh3What we offer: /h3ulliItalian National Collective Labour Agreement for the Metalworking Industry (CCNL Metalmeccanico) /liliGross Annual Salary (RAL) ranging from strong€40,000 to €50,000 /strong, depending on experience, skills, and qualifications /liliJob grade to be determined upon completion of the selection process, with final assessment between B2 and B3 level /liliOpportunity to join a leading international technology group operating in the financial services industry /liliExposure to enterprise-scale cybersecurity governance activities within a dynamic and international environment /li /ulh3Location: /h3pAccording to the Italian Law (L.*****), candidates belonging to the protected categories list will be given priority.
/p /p #J-*****-Ljbffr

📌 Vulnerability Governance Analyst, Italy (Milano)
🏢 Ion Group
📍 Milano