Security findings in banking do not wait for the right moment to be resolved. The Exposure Management Analyst role in Madrid sits at the intersection of technical teams and compliance, where every finding needs clear ownership and timely closure. The mandate is to keep remediation moving, so nothing stalls and every item is tracked from discovery to resolution. You decide how exposures are managed, escalated and evidenced for audit, shaping our client’s response to evolving risks. The impact of this role is seen in our client’s ability to maintain security standards and respond quickly to new threats.
This is a hybrid role based in Madrid's city center, ideal for those eager to thrive in a dynamic environment and make a significant impact in private banking technology. Join EPAM and contribute to shaping the future of financial services in Spain!
Responsibilities
Manage security findings and remediation tasks end to end across penetration test findings, security baseline deviations and infrastructure vulnerabilities
Assign and route remediation tasks to correct technology owners, adjusting routing rules as ownership changes
Evaluate and approve or reject false-positive requests by analyzing technical evidence and vulnerability output
Investigate technical content within security reports and scan output to determine system impact and coordinate retesting
Monitor coverage and deviations against security baselines while following up on remediation plans
Lead cross-functional remediation efforts for findings spanning multiple organizational boundaries
Act as a central point of contact to support solution owners, answer questions, handle escalations and simplify mitigation
Ensure process assurance by completing documentation and maintaining audit-ready responses meeting internal policies
Produce operational reporting on remediation performance, risk indicators and progress for technical teams and management
Escalate stalled exposures or missed deadlines and engage cyber incident response colleagues when critical exposures are confirmed
Requirements
Relevant degree in cybersecurity, computer science, information technology or a comparable technical discipline
Practical experience in vulnerability management, security compliance, penetration testing or information security operations
Solid understanding of infrastructure vulnerabilities, security baselines and penetration test findings within enterprise environments
Strong analytical skills with the ability to interpret technical security reports, scan outputs and false-positive claims
Effective communication and stakeholder management skills for coordinating remediation across technical teams
Methodical approach to tracking tasks, maintaining documentation and ensuring compliance with regulatory standards
Proactive problem-solving abilities with a willingness to learn, adapt and improve operational processes
Fluent English language skills with clear written and verbal communication capabilities
Nice to have
Prior experience working within banking, financial services or highly regulated corporate environments
Familiarity with security exception processes and collaboration with security architecture teams
Experience utilizing automated vulnerability scanners, security ticketing systems and operational reporting dashboards
Knowledge of modern threat landscapes, risk quantification and cybersecurity incident response procedures
English
Pay
Pay is not stated in the ad.
Estimate take-home pay for a figure you enter
Estimated take-home pay
Explore gross pay after typical payroll taxes for a work location.
Illustrative estimate only; assumes a standard employee profile and may omit benefits, pensions, credits and local rules. Regional and city-specific tax applies only where the selected calculator supports it; other results are country-level. Salary and location are sent only when you calculate: Paysums for supported regions, or WorthOf for wider country coverage. Confirm with an official payroll or tax source before making decisions.
Visa sponsorship and relocation: not stated in the ad.
JobCheckPoint never asks candidates to pay, and genuine employers shouldn't either. If this job asks you for money (registration, training, visa or equipment fees), don't pay. Report it below.
