Group IT Security Vulnerability Analyst

National Express Group is a leading public transport operator with bus, coach and rail services in the UK, Continental Europe, North Africa, North America and the Middle East. Passengers made 939 million journeys on our services in 2019.

The successful candidate will play a key role in the operation of IT security for National Express Group PLC. A hands-on role that is paramount to execute IT security services to the required standard at a Group level and liaising with multiple stakeholders and division teams. The Group IT Security Vulnerability Analyst will bring a wealth of technical knowledge and apply it on a daily basis, be responsible for the correct execution of key security testing services and act as a key point of contact for Group IT security matters associated with such services. 

What you’ll do:

• Operate key IT security services to support activities concerning IT security assessment to determine any gaps that require mitigation and communicate risks to the appropriate stakeholders including attack surface mapping and execution/processing of vulnerability scans

• Facilitate, organise and execute on a periodic basis the relevant IT security services (e.g. vulnerability and web application scanning)

• Verify output of automated security testing tools associated to the the relevant IT security services

• Ensure the compliance level of the Group divisions against the relevant security services 

• Provide input to improve IT security governance, policies and procedures from observations made on a day-to-day basis in collaboration with the Group divisions 

• Support the IT security assessment of prospective acquisitions of companies leveraging existing IT security services

• Respond to IT security incidents, suspicious activity or alerts reported by the Group divisions to support investigation, detection, containment or verification activities (including, but not limited, the usage of existing IT security services)

• Support IT security initiatives and efforts across the Group concerning the IT security services 

• Advise Group divisions on execution of the IT security services  

• Produce operational Group IT security KPIs on a periodic basis associated to the IT security services

• Act as a Group point of contact for ad-hoc enquiries, troubleshooting issues and general support concerning the IT security services 

• Liaise with the Group IT security representatives to exchange knowledge and promote Group wide strategic and tactical initiatives  

• Own and coordinate IT security service meetings held on a periodic basis with Group representatives 

• Appraise IT security risks associated to the IT security services and provide input to the Group IT security risk register 

• Create summaries, updates and reports with the relevant periodicity required for each of the IT security services 

• Communicate proactively and effectively with all stakeholders, internal teams, suppliers and any other involved party in the IT security services

What you’ll have:

• Experience in corporate IT Security processes and technology

• A recognised certification in IT security (e.g. CompTIA Security+)

• Knowledge and experience of penetration testing and vulnerability management

• Experience of web application testing using a product such as Burp Suite or Zap Proxy

• Knowledge of the OWASP Web Application Security Risks (e.g. top 10, testing guide)

• Ability to support IT security incidents, IT security advisories and IT security issues collating technical and functional information to define mitigating actions leveraging the IT security services 

• Ability to create, review or amend corporate documents related to vulnerability management including but not limited to policies, procedures and standards 

• Ability to support conversations with a broad set of stakeholders, including but not limited to, executive staff, third party suppliers, technical teams and functional teams 

• General IT technical knowledge including but not limited to networks, operating systems, databases, application servers, web servers, cloud security (e.g. multi-tenancy, public/private implementations, SaaS, PaaS, IaaS), end-point security (e.g. hardening, anti-malware, EDR) and network security (e.g. IDS/IPS, SIEM, DDOS mitigation and WAF) 

• Experience in multi-leveled organisations to identify IT security risks

• Experience with Linux and Bash

• Experience of a scripting language (e.g. Python, Ruby, Perl)

• Experience using nmap or similar port/service scanning tools

• Experience using a commercial vulnerability scanner (e.g. Nessus, Qualys, Rapid7)

• Experience using a commercial automated web application scanner (e.g. AppCheck, Rapid7, Netsparker)

• Ideally but not necessarily required:

  • Experience implementing, using or managing any of the following: EDR, PAM, Active Directory, IDS, IPS, SIEM or SOAR

  • Spanish verbal and written communication skills

  • A recognised certification in penetration testing (e.g. CompTIA PenTest+, CEH, GPEN, CREST, OSCP)

What we offer:

• A core salary aligned with your professional experience

• Company pension scheme

• Participation in the bonus programme

• Private medical insurance

• Holiday allowance

• Flexible and smart working (subject to business needs)

• Free travel for you and your partner

• Access to the NX Health Bus

• Employee Assistance Programme

• Variety of deals and discounts available through the NX online portal

At National Express, we are really proud of our health and safety record and as a result, we operate a Drugs and Alcohol Policy which is applicable to all employees.

As part of your initial assessment, we will complete Drug and Alcohol testing and you may be subject to random tests during your employment.