Manager - Security Engineer Vulnerability and External Attack Surface Management

Responsibilities

The Security Engineer – Vulnerability & EASM (External Attack Surface Management) will be responsible for the following:

Vulnerability Management (core)

Manage the vulnerability management lifecycle – discovery, validation, prioritization, remediation tracking and verification – across infrastructure, cloud, applications and telecom/OT assets.

Operate and tune enterprise vulnerability scanning platforms (e.g., Tenable, Qualys), ensuring complete and accurate asset coverage.

Define and enforce risk-based remediation SLAs; partner with infrastructure, application and platform teams to drive closure.

Maintain authoritative vulnerability and asset inventories, reducing false positives through validation and contextual enrichment.

External Attack Surface Management (EASM)

Continuously discover, map and monitor MTN's internet-facing assets – including shadow IT, exposed services, certificates, domains and cloud footprints.

Operate EASM tooling (e.g., Microsoft Defender EASM, Shodan) to surface exposure before adversaries do.

Correlate external exposure with internal vulnerability and threat data to produce a unified, prioritized view of organizational risk.

Drive rapid remediation of high-risk external exposures and unauthorized or unmanaged assets.

Practical Risk & Remediation

Translate technical findings into business risk – prioritizing by exploitability (CVSS, EPSS, CISA KEV), asset criticality and threat context, not raw vulnerability counts.

Recommend pragmatic, achievable remediation and compensating controls; avoid unmanageable "boil-the-ocean" backlogs.

Lead targeted remediation campaigns and track measurable reductions in exploitable risk over time.

Threat Analysis & Forward-Looking Defence

Integrate threat intelligence to contextualize vulnerabilities against active exploitation and threat-actor behavior.

Anticipate emerging exposure – new CVEs, attack techniques, supply-chain and cloud risks – and proactively assess MTN's susceptibility.

Contribute to detection, hardening and resilience improvements informed by attacker tradecraft (MITRE ATT&CK).

AI-Driven Innovation & Thought Leadership

Pioneer the use of agentic AI and large-language-model platforms (e.g., Anthropic Claude / Claude Code or equivalent) to automate vulnerability triage, enrichment, remediation guidance and reporting.

Design and prototype AI-assisted workflows that scale VM and EASM operations across MTN's Group markets.

Stay ahead of developments in AI, offensive tooling and exposure management, bringing best practice into the team

Qualifications

Qualifications

Bachelor's degree in Computer Science, Information Security, Engineering or a related field – or equivalent practical experience.

6+ years in information security, with at least 3–4 years dedicated to vulnerability management and/or attack surface management.

Demonstrable experience operating enterprise VM and EASM tooling at scale.

Hands-on scripting/automation (Python, PowerShell) and data analysis capability.

Proven track record of driving measurable risk-reduction and remediation outcomes.

Exposure to AI / agentic-AI tooling applied to security operations – strongly preferred

Preferred Certifications

OSCP, GIAC (e.g., GWAPT, GEVA, GCTI), CISSP, CEH or equivalent.

Cloud security certifications (e.g., AZ-500, AWS Security Specialty, CCSP).

Technical Skills & Tools

Vulnerability management: Tenable / Qualys or equivalent.

Attack surface management: Microsoft Defender EASM / Shodan or equivalent.

Prioritization frameworks: CVSS, EPSS, CISA KEV.

Threat frameworks: MITRE ATT&CK; threat-intelligence integration.

Cloud security: Azure / AWS / GCP exposure management.

Data & automation: Python, SQL, Power BI, SOAR / workflow automation.

AI: agentic-AI / LLM platforms (Anthropic Claude / Claude Code or equivalent); prompt and workflow design.

Behavioural Competencies

Forward-thinking and curious – anticipates rather than reacts.

Strong communicator who translates technical risk for non-technical audiences.

Pragmatic problem-solver focused on real-world, achievable remediation.

Collaborative, with the credibility to influence across teams and markets.

Self-driven thought leader who raises the capability of those around them.