CSIRT Vulnerability Analyst

About the role

The Statkraft CSIRT team, part of the Cyber Security department, identifies and assesses security risks and coordinates responses to vulnerabilities and security events. As an experienced Vulnerability Analyst, you will protect Statkraft's digital assets, infrastructure and applications by identifying, analyzing, validating, prioritizing and following up vulnerabilities. The role requires physical presence at the main office in Lilleaker, Oslo.

Key responsibilities

• Perform vulnerability assessments across digital infrastructure, applications, cloud environments and assets using commercial and open-source tools.
• Analyze identified vulnerabilities, combining technical findings, threat intelligence and business context to assess risk and prioritize remediation.
• Investigate emerging vulnerabilities and threats and give actionable recommendations to system owners and technical teams.
• Follow up on vulnerabilities and work with IT, development, cloud and system owners to support timely, risk-based remediation within SLAs.
• Explore and apply AI to improve vulnerability analysis, prioritization and efficiency, while critically assessing AI-generated insights.
• Contribute to improving vulnerability management processes, tools, automation, dashboards and technical capabilities.
• Support security investigations, threat hunting and security assessments.

Required profile

• Experience in cybersecurity, vulnerability management, security operations, incident response or a related technical security field.
• Knowledge of vulnerability lifecycles, common attack techniques, operating systems, networks, cloud technologies and application security.
• Knowledge of AI, especially frontier AI and its implications for vulnerability management.
• Fluency in Norwegian and English, spoken and written.
• Eligibility for Norwegian security clearance and authorization.

Required skills

• Practical experience with vulnerability assessment and scanning tools such as Tenable/Nessus or Microsoft Defender Vulnerability Management.
• Advantage: scripting or query skills in Python, PowerShell, KQL, Go or Bash.
• Advantage: familiarity with NIST CSF, NIST SP 800-53, ISO 27001 and CIS Controls, and experience with AppSec, DevSecOps and SAST/DAST tooling.

What we offer

• Unlimited learning opportunities and a global network of experts and colleagues.
• A flexible work culture emphasizing work-life balance.
• Competitive terms of employment and benefits, with a focus on safety.