1. EQUANS 

Equans is a world leader in the energy and services sector, with annual revenues of nearly €19,2 billion* and almost 800,000 projects.​ 

Equans has leading positions in Europe, which is the result of the history of energy construction in these countries, and strong presences in North and South America and in Oceania.​ 

With nearly 90,000 highly skilled employees, Equans has a strong geographic footprint, anchored by historic local brands. Equans provides its customers with excellent technical expertise in the design, installation, maintenance, and operation of multi-technical facilities. This know-how is based on key skills. First of all, in electrical and thermal engineering - two strong points that help accelerate the reduction of our clients' carbon footprint - but also in ventilation, refrigeration, mechanics and robotics, fire protection, energy renovation, digital solutions, IT, cyber security and telecommunications.​ 

The combination of thes expertises allows us to offer efficient and optimised solutions at all stages of the energy chain, from production, storage and transport to usage. 

(*) Turnover 2024 consolidated 

1. Vulnerability Analyst (F/M) 

Summary of the role 

We are seeking a highly analytical and threat-aware Vulnerability Analyst to join our cybersecurity team. This role is focused on tracking, analyzing, contextualizing vulnerabilities and taking the lead on actions to conduct to improve Equans security posture. Reporting to the Head of Active Defense, the Vulnerability Analyst will be a key member of the Vulnerability Management & Compliance Team (VMCT) which is responsible for monitoring and managing vulnerabilities across Equans perimeters that are under the SLS Cyberdefense scope. 

KEY METRICS OF THE ENVIRONMENT 

• Equans operates on a global scale, overseeing and maintaining a vast digital landscape. The asset portfolio monitored by the VMCT team includes more than 20 000 servers, network devices, and cloud resources distributed across multiple continents (+20 countries). This extensive infrastructure supports critical operations and requires continuous, adaptive security strategies to remain resilient against emerging threats. 

• More than 180 000 scans are conducted monthly.  

• VMCT is currently composed of 5 vulnerability managers and 1 SDM. Working closely with the SecOps engineers and the Red Team under the Active Defense leadership. 

• 60% of the vulnerability analyst's time will be allocated to vulnerability analysis, enrichment, and reporting. The remaining 40% will be spent advising Business units to support their understanding of backlog items and facilitate backlog reduction. 

KEY OBJECTIVES & KPIs 

• Communicate weekly analyses to CISOs from each business unit and technical teams, aiming to raise awareness and align everyone toward common goals. 

• Ensure that 100% of critical CVEs of interest are assessed and communicated to relevant teams within 12–24 hours of publication. 

• Collaborate with business units to reduce their individual backlog by at least 25% per quarter, with tailored actions plans. 

TOOLING (To be hidden before large diffusion) 

• Tenable.io 

• WIZ 

• CrowdStrike 

• Ivanti RBVM 

• ServiceNow 

• OpenCTI 

KEY RESPONSIBILITIES 

• Track and analyze newly disclosed vulnerabilities (CVEs) with a focus on exploitation in the wild. 

• Stay current with public advisories, vendor bulletins, and security research to identify relevant threats. 

• Assess vulnerabilities in the context of our technology stack, architecture, and Equans business activities. 

• Prioritize vulnerabilities based on exploitation likelihood, threat actor interest, relevance to our environment and potential impacts. 

• Maintain a curated list of high-risk vulnerabilities and provide actionable insights to remediation teams. 

• Collaborate with stakeholder teams to support mitigation strategies. 

• Produce concise, high-impact reports and briefings for technical and leadership audiences. 

• Work with patch managers of different business units and act as an advisor across the vulnerability remediation cycle.  

• Support vulnerability scanning and penetration testing efforts.  

• Participate in committees (WOCC) as a vulnerability referent. 

• Collaborate with CSIRT threat hunting, incident response and threat management teams. 

Vulnerability Monitoring & Intelligence Gathering:  

- Continuously monitor trusted sources (e.g., NVD, CISA KEV, vendor advisories, threat intel feeds) for new disclosed CVEs as well as newly exploited ones.  

- Track and assess vulnerabilities relevant to the organization’s network perimeters. 

Exploitation tracking: 

- Monitor for PoC exploits or active exploitation in the wild.  

- Coordinate with Equans CSIRT to detect signs of exploitation and improve threat hunting capabilities. 

Impact assessment: 

- Analyze the technical details of every CVE of interest.  

- Evaluate the potential impact on the organization’s assets, systems and services.  

- Prioritize vulnerabilities based on risk (CVSS, exploitability, assets criticality). 

     Attack Surface Management:  

- Control daily operation through VMCT tooling. 

- Ensure the assets database hygiene, create tagging policy, assign assets to BUs and remove wrong detections. 

- Open and track vulnerability tickets. 

- Produce reports for Equans cybersecurity committee and remediation plans. 

Contextualization for the organization: 

- Map vulnerabilities to the organization’s technology stack (e.g., OS, applications, firmware, cloud services).  

- Collaborate with IT and business units to identify affected systems.  

- Provide tailored risk assessments and remediation recommendations.  

Reporting & Communications: 

- Create clear, actionable vulnerability reports for technical and non-technical stakeholders.  

- Create and maintain a vulnerability remediation catalogue.  

- Communicate verbal analyses to stakeholders.  

PROFILE  

Academic background & Experience  

• Minimum of 5 years’ experience as a security analyst, with at least 3 years as a vulnerability threat analyst. 

Behavioral Capabilities​ 

• Excellent problem-solving and analytical skills, with the ability to troubleshoot complex access governance issues and implement effective solutions.​ 

• Ability to communicate effectively with both technical and non-technical stakeholders, ensuring clarity in explaining complex technical concepts.​ 

• Strong collaboration skills, working seamlessly with cross-functional teams such as IT, security, and compliance.​ 

• Results-driven with a focus on delivering high-quality solutions and achieving business objectives.​ 

• Highly organized with the ability to manage multiple projects and prioritize tasks effectively.​ 

• Comfortable working in a multicultural, distributed team. 

Skills 

• Through knowledge of CVE databases (NVD, MITRE), CISA KEV and vendor advisories.  

• Experience with vulnerability scanners (e.g., Tenable, WIZ, CrowdStrike).  

• Deep knowledge of vulnerabilities prioritization models (e.g., CVSS, EPSS, KEV). 

• Experience with vulnerability threat management workflows in OpenCTI is a plus.  

• Ability to script for automation and data analysis using Python or similar scripting language.  

• Participate in the improvement and development of process and procedure documentation. 

• Ability to multi-task and prioritize. 

• Proactive operation mindset. 

• Curious and have good verbal and written communication skills. 

• Ability to remain resilient and responsive during critical vulnerability disclosures, ensuring swift analysis and action under time-sensitive conditions. 

Why Join Us? 

Motivational Environment 
Join a dynamic team of passionate professionals, actively involved in prestigious cybersecurity collaboration networks. Be part of a culture that values excellence, innovation, and mutual support. 

Challenging Topics 
Contribute to multiple high-impact projects that tackle real-world cybersecurity challenges. Your expertise will make a difference. 

Empowered Voices 
Your ideas matter. As a valued team member, your input will be heard, respected, and considered in decision-making processes. 

Technical Growth 
Advance your skills through tailored training programs and hands-on experience. We invest in your development to help you reach your full potential.