CSIRT Vulnerability Analyst

The Statkraft CSIRT team is part of the Cyber Security department in Statkraft. Our mission is to avoid or minimize business impact from attempted or conducted cyber-attacks against Statkraft’s assets. We identify and assess security risks and coordinate the response to vulnerabilities and security events.
In a constantly evolving digital landscape, staying ahead of emerging threats is critical. As our new experienced Vulnerability Analyst, you will play an important operational role in protecting our digital assets, infrastructure, and applications. You will join a highly skilled cybersecurity team where your primary focus will be to identify, analyze, validate, prioritize, and follow up vulnerabilities across our technology environment, ensuring that security weaknesses are understood and addressed before they can be exploited.
You will work hands-on with the vulnerability management lifecycle, including vulnerability scanning and assessment, validation of findings, risk-based prioritization, remediation tracking, and reporting. You will analyze technical vulnerabilities and their potential impact, distinguish meaningful security risks from false positives and low-risk findings, and provide clear and actionable remediation guidance to infrastructure, application, cloud, and development teams.
A key part of your role will be to translate technical vulnerability information into practical risk and remediation priorities. You will work closely with system owners and technical teams to ensure vulnerabilities are addressed within defined Service Level Agreements (SLAs), investigate overdue or recurring vulnerabilities, and contribute to improving vulnerability coverage, data quality, and operational processes.
You will also monitor emerging vulnerabilities and threats, including newly disclosed vulnerabilities and vulnerabilities with known or suspected exploitation, and help determine their relevance to our environment. Through continuous analysis, collaboration, and follow-up, you will contribute directly to strengthening our security posture and protecting critical infrastructure across several countries.
Your responsibilities include:
Performing vulnerability assessments across Statkraft’s digital infrastructure, applications, cloud environments, and assets using commercial and open-source tools.
Analyzing identified vulnerabilities and combine technical findings, threat intelligence, and business context to assess risk and prioritize remediation.
Investigating emerging vulnerabilities and threats, assess their potential relevance to Statkraft, and provide actionable recommendations to system owners and technical teams.
Following up on identified vulnerabilities and working with IT, development, cloud, and system owners to support timely and risk-based remediation.
Exploring and applying AI to improve vulnerability analysis, prioritization, enrichment, and efficiency, while critically assessing the quality and reliability of AI-generated insights.
Contributing to the continuous improvement of vulnerability management processes, tools, automation, dashboards, and technical capabilities.
Supporting security investigations, threat hunting, and security assessments where vulnerability expertise can help identify exposure and reduce cyber risk.
We are looking for passionate colleagues who are excited to make an impact and bring a mix of mindset and skills to the team. This includes:
Experience in cyber security, vulnerability management, security operations, incident response, or related technical security field.
Practical experience with vulnerability assessment and scanning tools such as Tenable/Nessus, Microsoft Defender Vulnerability Management, or similar platforms.
Good understanding of vulnerability lifecycles, common attack techniques, operating systems, networks, cloud technologies, and application security.
Knowledge within the field of AI, especially frontier AI and related consequences for vulnerability management.
Strong analytical and critical-thinking skills, with the ability to turn technical findings and data into clear risk assessments and recommendations.
Scripting or query skills in Python, PowerShell, KQL, Go, Bash, or similar technologies are an advantage.
Fluency in Norwegian and English, both spoken and written.
We believe the following skills and experiences would be beneficial:
Solid networking and communication skills with the ability to easily connect with new people.
Independent personality able to work well both solo and in various teams spanning across countries, cultures and languages.
Familiarity with cyber security frameworks such as NIST CSF, NIST SP 800-53, ISO 27001, and/or CIS Controls.
Experience with Application Security (AppSec), DevSecOps, and SAST/DAST tooling.

Employment type
Full-time

Work arrangement
Hybrid