Solution Architect - Vulnerability Intelligence & Detection Response (Armis/VMDR)

About the role

ServiceNow is expanding its Vulnerability Intelligence, Prioritization & Detection Response (VIPR/VMDR) capability to strengthen Armis' cyber defence globally. This role leads the integration of vulnerability discovery, detection, intelligence enrichment, prioritisation and coordinated response into a unified customer programme across EMEA. It combines vulnerability lifecycle management with exploit intelligence, detection automation and cross-functional coordination (ITSM). The position is based in Spain.

Key responsibilities

• Own the end-to-end vulnerability and detection lifecycle, from discovery and triage through prioritisation, remediation and reporting.
• Lead the VIPR/VMDR function, integrating threat intelligence, exploit data and asset context to drive data-backed decisions.
• Correlate internal vulnerability telemetry with external feeds (NVD, CISA KEV, EPSS, Mandiant, Shodan, VulnDB, Centrix for Early Warning) to assess exploitability and exposure.
• Operate and tune vulnerability and detection tools (e.g. Tenable, Qualys, Rapid7, Wiz, Prisma Cloud, ServiceNow VR) across hybrid customer environments.
• Automate vulnerability scoring, detection correlation and reporting pipelines using Python, PowerShell, REST APIs or automation rules within AMS/VIPR.
• Partner with Customer Success, Security Engineering and Cloud Infrastructure teams to track remediation SLAs, exposure metrics and MTTR improvements.
• Build and publish risk dashboards, customer-facing reports and executive briefings using Splunk, Power BI, Elastic or AMS/VIPR.
• Develop and maintain the Armis Vulnerability Prioritization Model, aligning exploit intelligence, CVSS/EPSS scoring, proprietary risk scoring and business criticality.
• Support penetration test remediation, red team findings and customer security audits, and author weekly intelligence reports and zero-day summaries.
• Deliver training and enablement workshops for customers, engineers and analysts.

Required profile

• 6-10+ years of experience in Vulnerability Management, Threat Intelligence or Security Detection Engineering.
• Bachelor's or Master's degree in Information Security, Computer Science or a related discipline.
• Previous experience in a Voice of the Customer technical role embedded with Product Engineering pods.
• Track record of mentoring senior technical staff and developing knowledge-sharing frameworks.
• Preferred: enterprise SaaS or customer-facing technical programmes, certifications such as CISSP, GCCC, GCTI, CEH or CySA+, and experience with SOC 2, ISO 27001 or FedRAMP.

Required skills

• Deep expertise in CVSS, CWE/CVE, NVD, KEV and EPSS.
• Hands-on experience with Tenable, Qualys, Rapid7, Wiz, Prisma Cloud, ServiceNow VR and Centrix for VMDR.
• Automation scripting and data pipelines in Python, PowerShell, Bash and REST APIs.
• Risk-based vulnerability management and cloud-native security (AWS, Azure, GCP).