Assistant Manager, Cyber Engineering- Vulnerability Management and Compliance-Hyderabad

Hyderabad, Telangana, India

The Deloitte Member firms Cyber Engineering team designs and operates cyber capabilities that help protect the organization’s technology estate and business operations. The team works across application, infrastructure, cloud, identity, endpoint, and security engineering groups to improve security hygiene, manage technical risk, and support strategic security initiatives.

Location: Hyderabad

• 6-7.5 years of experience leading vulnerability or exposure management programs across cloud, infrastructure, application, endpoint, identity, container, and third-party technology environments.
• Experience assessing exploitability through runtime context, attack-path analysis, exposure analysis, and business-impact assessment beyond Common Vulnerability Scoring System (CVSS) scores.
• Experience administering or integrating at least one vulnerability or exposure management platform: Qualys, Microsoft Defender Vulnerability Management, Wiz, Tenable, or Rapid7.
• Experience with Microsoft Azure and Amazon Web Services (AWS) cloud-native architectures.
• Experience with web applications, application programming interfaces (APIs), libraries, packages, frameworks, runtimes, application servers, web servers, operating systems, kernels, identity systems, authentication technologies, containers, Kubernetes, microservices, and continuous integration and continuous delivery (CI/CD) pipelines.
• Experience automating security workflows with PowerShell, Python, Kusto Query Language (KQL), or Representational State Transfer (REST) APIs.

• Experience leading remediation programs across multiple technology teams.
• Experience managing analysts or leading technical security initiatives.
• Experience evaluating artificial intelligence platforms, artificial intelligence agents, large language model ecosystems, artificial intelligence governance, attack vectors, or security controls.
• Experience applying threat intelligence, vulnerability intelligence, attack-path analysis, runtime security, or MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK).
• Experience applying the National Institute of Standards and Technology Cybersecurity Framework, National Institute of Standards and Technology Artificial Intelligence Risk Management Framework, Center for Internet Security Controls, Open Worldwide Application Security Project guidance, or International Organization for Standardization 27001.
• One or more of the following certifications: Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), Microsoft Cybersecurity Architect (SC-100), Microsoft Azure Security Engineer Associate (AZ-500), Global Information Assurance Certification (GIAC) Security Essentials (GSEC), GIAC Penetration Tester (GPEN), GIAC Critical Controls Certification (GCCC), or Amazon Web Services (AWS) Certified Security – Specialty.

Our purpose

Deloitte’s purpose is to make an impact that matters for our people, clients, and communities. At Deloitte, purpose is synonymous with how we work every day. It defines who we are. Our purpose comes through in our work with clients that enables impact and value in their organizations, as well as through our own investments, commitments, and actions across areas that help drive positive outcomes for our communities. Our people and culture

Our inclusive culture empowers our people to be who they are, contribute their unique perspectives, and make a difference individually and collectively. It enables us to leverage different ways of thinking, ideas and perspectives, and bring more creativity and innovation to help solve our clients’ most complex challenges. This makes Deloitte one of the most rewarding places to work. Professional development

At Deloitte, professionals have the opportunity to work with some of the best and discover what works best for them. Here, we prioritize professional growth, offering diverse learning and networking opportunities to help accelerate careers and enhance leadership skills. Our state-of-the-art DU: The Leadership Center in India, located in Hyderabad, represents a tangible symbol of our commitment to the holistic growth and development of our people. Explore DU: The Leadership Center in India. Benefits to help you thrive

At Deloitte, we know that great people make a great organization. Our comprehensive rewards program helps us deliver a distinctly Deloitte experience that helps that empowers our professionals to thrive mentally, physically, and financially—and live their purpose. To support our professionals and their loved ones, we offer a broad range of benefits. Eligibility requirements may be based on role, tenure, type of employment and/ or other criteria. Learn more about what working at Deloitte can mean for you.

Recruiting tips

From developing a stand out resume to putting your best foot forward in the interview, we want you to feel prepared and confident as you explore opportunities at Deloitte. Check out recruiting tips from Deloitte recruiters.

Requisition code: 373480

Lead enterprise vulnerability and exposure management capabilities that reduce technical risk across cloud, artificial intelligence, applications, infrastructure, endpoints, identities, and third-party technologies. This role advances a traditional Common Vulnerabilities and Exposures (CVE)-driven process into a risk-based, intelligence-driven capability that helps technology teams identify, prioritize, and remediate security weaknesses. Partner with engineering and security stakeholders to translate complex technical vulnerabilities into actionable business risk and measurable security-posture improvements.

Work you'll do

As a Vulnerability Management & Compliance professional on the Cyber Engineering team, you will be responsible for:

• Lead the enterprise vulnerability and exposure management program across cloud, infrastructure, applications, containers, artificial intelligence platforms, endpoints, identities, and third-party technologies.
• Establish risk-based prioritization methods that combine threat intelligence, exploitability, attack paths, asset criticality, internet exposure, runtime context, compensating controls, and business impact.
• Assess newly disclosed vulnerabilities; validate organizational exposure; guide response strategies for critical and actively exploited vulnerabilities.
• Administer, optimize, integrate, and govern vulnerability and exposure management platforms, including Qualys, Microsoft Defender Vulnerability Management, container and cloud security platforms, attack-surface management solutions, and threat-intelligence integrations.
• Develop controls and metrics for asset hygiene, password and credential management, endpoint health, baseline configuration, patch compliance, privileged access hygiene, cloud and artificial intelligence security posture, and vulnerability remediation service-level objectives; build dashboards, scorecards, compliance reporting, and automation for remediation workflows.
• Partner with engineering and security stakeholders; lead remediation campaigns; communicate technical risk to leadership; mentor vulnerability management analysts and engineers; and evaluate emerging attack techniques and security capabilities across artificial intelligence, cloud-native, and identity technologies.