1. Vulnerability Management
Vulnerability Management Platform Administration
? Full management, configuration, and troubleshooting of the Qualys VM platform including QualysGuard, Policy Compliance (PC), Virtual Scanners, Qualys Cloud Agents, and Certificate Management.
? Deployment and lifecycle management of Qualys components (Virtual Scanners, Gateway Servers, Cloud Agents) across all MAF operational regions and cloud environments (Azure, GCP).
? Regular patching, upgrade coordination, and performance tuning of the Qualys platform.
? Configuration of scan policies, schedules, alerting, dashboards, and reporting templates in alignment with MAF standards and security policy.
? Maintain integration with SIEM, ticketing systems, and other dashboards as needed.
Asset Discovery and Coverage Expansion
? Perform continuous asset discovery and mapping to maintain accurate visibility of all IT and OT assets (servers, network/security devices, applications, cloud workloads).
? Ensure onboarding and classification of all existing and newly provisioned assets within the VM platform.
? Maintain an up-to-date asset inventory linked to vulnerability scanning and compliance assessments.
Vulnerability Scanning and Assessment
? Conduct monthly vulnerability scans for all onboarded assets (or at a defined frequency as per MAF policy).
? Monthly Map scan (discovery scan).
? Perform external scans for all public-facing IPs to identify exposed or unprotected services.
? Execute on-demand scans for specific assets or business units as requested.
? Perform initial scans for new assets before they are moved to production.
Risk Prioritization and Remediation Management
? Analyse vulnerability assessment results, prioritize findings based on risk and exploitability, and collaborate with relevant teams to define response actions.
? Coordinate with application, infrastructure, and cloud teams to ensure timely application of patches, configuration fixes, and compensating controls.
? Follow up and track closure of remediation actions as per SLA timelines defined by MAF.
? Maintain a central vulnerability register, including data from other sources (e.g., penetration tests, bug bounty programs).
Exception Handling and SLA Monitoring
? Document and maintain exception records for critical vulnerabilities (P1, P2) where remediation is deferred, with justifications and defined review cycles.
? Ensure all remediation and exception activities comply with agreed SLA and are tracked to closure.
Policy and Access Management
? Manage platform access rights, ensure segregation of duties, and perform quarterly access reviews for all users of the VM platform.
? Maintain platform configuration aligned with vendor best practices and MAF?s approved security policies.
Reporting and Communication
? Provide monthly vulnerability status reports with insights on trends, open vulnerabilities, remediation rates, SLA compliance, and risk exposure.
? Generate on-demand reports and dashboards tailored to specific business units or technology domains.
? Maintain custom dashboards for executive, operational, and compliance reporting, Dashboard should provide full details of the current status of the vulnerability management, and must be segregated according to the business requirements
? Maintain logs of all cases reported to Qualys support, and track resolution.
Business Continuity and DR
? Develop, maintain, and test the business continuity and disaster recovery (BC/DR) plan for the VM solution, ensuring platform availability and data resilience across all supported regions.