Senior Security Compliance Assessor

In this role, you will help strengthen Nokia's security posture by driving governance, accountability, and measurable risk reduction across IT infrastructure, applications, development pipelines, and cloud environments. You will work closely with the Digital Office, IT Operations, Business Segments, application and DevOps teams, and external partners. You'll turn threat intelligence and technical findings into clear priorities, decisions and remediation actions, and report progress and risk to leadership.

• Master's degree in Computer Science or a related field, with specialization in Cybersecurity or Information Security.
• Fluent English.
• 7+ years of experience in cybersecurity, including at least 3 years in vulnerability management, patch management and/or security governance.
• Strong understanding of vulnerability prioritization (CVSS, EPSS, KEV, exploitability, exposure) and remediation governance in large enterprise environments.
• Practical understanding of enterprise patch management processes, including patch cycles, emergency patching and maintenance windows.
• Good understanding of application security testing (WAS, SAST, DAST), including interpreting results, handling false positives and following remediation through application teams.
• Working knowledge of CI/CD pipelines, DevSecOps practices and software supply chain risks (dependencies, SBOM, code signing, secrets management, third-party tooling).
• Proven experience in governance, risk and compliance activities, including KPI definition, risk reporting and stakeholder escalation.
• Ability to translate technical findings into clear, concise messages for both technical teams and leadership.
• Experience working with diverse stakeholders and driving outcomes without direct authority.
• Strong analytical and problem-solving skills; able to work independently and as part of a team.

• It would be nice if you already have or aspire to pursue:

• Certifications such as CISSP, CISM or similar.
• Experience with enterprise vulnerability management, vulnerability remediation, endpoint management, and software composition analysis (SCA) tools.
• Basic cloud security knowledge (Azure, AWS or GCP) and familiarity with CSPM tools.
• Familiarity with frameworks such as NIST CSF, NIST SSDF, SLSA, ISO 27001 and CIS Benchmarks.
• Scripting or data skills (e.g., Python, Power BI) for automation and reporting.
• Awareness of emerging risks from AI tooling and agents in development environments.
   

• Vulnerability Management Governance: Oversee the end-to-end vulnerability management lifecycle (identification, threat-informed prioritization, remediation, exception handling and verification). Make sure remediation timelines match real exploitation risk, such as KEV, active exploitation and internet exposure.
• Patch Management Governance: Oversee patching cadence and compliance across infrastructure, endpoints and applications. This covers regular patch cycles, accelerated and emergency patching, maintenance window alignment, and tracking patch coverage and gaps.
• Application Security Testing Governance: Oversee web application scanning (WAS), SAST and DAST coverage and compliance across Nokia applications. Make sure findings are triaged, prioritized, and remediated on time, and that testing is built into the SDLC and CI/CD pipelines.
• Remediation Oversight and Escalation: Drive accountability with asset owners, IT Operations and suppliers. Follow up on overdue or high-risk findings, challenge weak remediation plans or compensating controls, and escalate when needed.
• CI/CD and Software Supply Chain Security: Define and monitor governance for build pipelines, developer tooling and third-party components. This includes open-source dependencies, IDE and AI-assistant plugins and extensions, secrets in pipelines, and supplier or package integrity.
• Metrics and Reporting: Define and maintain KPIs and risk indicators for vulnerability, patch and supply chain posture. Produce clear, decision-oriented reporting for stakeholders and leadership, covering trends, risks, blockers and required decisions.
• Compliance Monitoring: Run regular assessments to check compliance with Nokia security policies, regulatory requirements and industry standards. Identify gaps and track corrective actions to closure.
• Continuous Improvement: Improve processes, standards and automation across vulnerability, patch and supply chain governance, with a focus on simplification, standardization and operational efficiency.
• Cloud Security (supporting): Contribute to oversight of cloud security posture, mainly misconfigurations and exposure, as part of the overall risk view.
• Access Governance (supporting): Contribute to oversight of privileged and service accounts, least privilege and PAM onboarding where they relate to vulnerability, pipeline or cloud risk.