Security Delivery Analyst

Excelia is a multinational Consulting, Technology, and Professional Services firm with over 25 years of experience. We operate in more than 50 countries across Europe, Latin America, and the United States, participating in high-impact projects and international technological environments.

📢 We are looking for a Security Delivery Analyst / Security Transformation Analyst to join our team!

📍 Location: Madrid - Las Tablas
🏠 Hybrid model: 1-2 days on-site per week

🔹 What are we looking for?

We are looking for professionals in Cybersecurity and AppSec to participate in projects related to Security Delivery, Application Security, and transformation towards DevSecOps models.

The position will be especially focused on comprehensive vulnerability management, from identification and validation to prioritization, monitoring, and remediation, working in a coordinated manner with development and operations teams.

We are looking for both Junior and Senior profiles, adapting the level of responsibility to experience.

🛠️ Main responsibilities

• Manage the complete vulnerability lifecycle of applications.

• Analyze and validate vulnerabilities identified by different security tools.

• Identify and manage false positives.

• Perform triage and prioritization of vulnerabilities based on their criticality.

• Apply criteria such as CVSS and EPSS to determine priorities.

• Follow up on vulnerabilities until their remediation and closure.

• Analyze results from SAST, SCA, DAST, and IAST tools.

• Review code to validate and contextualize security findings.

• Collaborate with Development and Operations teams to define and monitor remediation plans.

• Participate in the integration of security controls within CI/CD pipelines.

• Contribute to the evolution of DevSecOps and SSDLC processes and methodologies.

• Identify opportunities for improvement and automation within the vulnerability management process.

• Communicate security risks clearly to technical teams and different stakeholders.

• Work with teams to prioritize vulnerability remediation while maintaining a balance between security, risk, and business needs.

💻 Technical knowledge

• Knowledge of the complete vulnerability management cycle:
  identification → validation → triage → prioritization → remediation → monitoring and closure.

• Knowledge of CVSS and EPSS.

• Ability to analyze false positives and validate the criticality of findings.

• SAST: Checkmarx, Fortify, SonarQube, Veracode.

• SCA: Snyk, Black Duck, Mend / WhiteSource.

• DAST / IAST: Burp Suite, OWASP ZAP, or other similar tools.

• Knowledge of SSDLC (Secure Software Development Life Cycle).

• Ability to read and understand code with the aim of validating vulnerabilities and security findings.

• Experience with the following will be valued:

  • Python

  • JavaScript / TypeScript

  • Java

  • C#

• Knowledge of pipelines and continuous integration and deployment processes.

• Jenkins

• GitLab CI

• GitHub Actions

• Azure DevOps

• Integration and automation of security controls within the development cycle.

🔐 Cybersecurity Fundamentals

• Solid knowledge of OWASP Top 10.

• Knowledge of CWE (Common Weakness Enumeration).

• Principles and best practices of secure architectures.

• Knowledge of Application Security and Secure by Design.

• Between 1 and 2 years of experience in Cybersecurity, software development, AppSec, or technical auditing.

• Exposure to Agile environments and methodologies.

• Knowledge of vulnerability management and application security fundamentals.

• Interest in developing within DevSecOps / SSDLC environments.

• More than 3-4 years of experience in Cybersecurity, AppSec, or related areas.

• Experience leading Application Security initiatives.

• Experience managing complete vulnerability cycles.

• Experience defining or improving DevSecOps / SSDLC processes.

• Ability to coordinate with Development, Operations, and Security teams.

• Good communication and negotiation skills with technical teams.

• Ability to explain vulnerabilities and risks clearly.

• Orientation toward collaboration with Development and Operations teams.

• Ability to advocate for the need for remediation without unnecessarily blocking the business.

• Orientation toward continuous improvement and the automation of security processes.