Manager - Security Engineer Vulnerability and External Attack Surface Management

,

for section headers,

• for lists, no CSS classes, no inline styles, no divs, no br tags. Preserve all original content word-for-word. Need to convert the given plain text into clean HTML. The input includes many styles and spans; we need to strip those and produce clean tags. Also need to handle "Context", "Values", "Live Y’ello", Qualifications, Preferred Certifications, Technical Skills & Tools, Behavioural Competencies, Vulnerability Management (core), External Attack Surface Management (EASM) sections. We should use

  for section headers like Responsibilities, Qualifications, Requirements, Education, Experience, Skills, How to Apply, Key Duties, About the Role. But here we have specific headers: Context, Values, Live Y’ello, Qualifications, Preferred Certifications, Technical Skills & Tools, Behavioural Competencies, Vulnerability Management (core), External Attack Surface Management (EASM). The instructions say use

  for section headers (e.g. Responsibilities, Qualifications, Requirements, Education, Experience, Skills, How to Apply, Key Duties, About the Role). So we should map these to appropriate h4 tags. For example: "Context" could be a paragraph or maybe h4? It's a section header. "Values" similarly. "Live Y’ello" is a list of values, maybe not a section header but it's a heading. I think we should treat each bolded phrase as a section header and wrap in

  . However, the instruction says "Use

  for section headers (e.g. Responsibilities, Qualifications, Requirements, Education, Experience, Skills, How to Apply, Key Duties, About the Role)". So we can use h4 for any of these. The job description has many sections. We'll keep them as h4. Also note that some lists are nested under subheadings like "Vulnerability Management (core)" and "External Attack Surface Management (EASM)". Those are also section headers, so h4. We need to preserve all content exactly, including the bullet points. The original uses

  with various margins. We'll just output plain paragraphs without style attributes. Also need to handle the "&" entities - they are already encoded as HTML entities, so we can keep them as is. The final output should be valid HTML. No extra whitespace except maybe line breaks? We can put everything in one block or separate lines. Since no CSS classes, no inline styles, no divs, no br tags. So we can just write the HTML with proper nesting. Let's parse the content step by step. First part: two introductory paragraphs. They are

  with spans. We'll convert to

  tags, removing span tags but keeping lang attribute? The instruction says preserve ALL original content word-for-word. The lang attribute might be considered part of content? Usually we keep the text content, but attributes are not content. The instruction says "Preserve ALL original content word-for-word — do not add, remove, summarise, or rephrase". That likely means the text content, not the formatting attributes. So we can drop the lang attribute, but maybe keep the lang attribute? The instruction says no CSS classes, no inline styles, no divs, no br tags. It doesn't say we must remove attributes. But typically we would remove style attributes and keep other attributes? The rule says "No CSS classes, no inline styles, no

  s, no
  tags". It doesn't forbid other attributes like lang. However, to be safe, we can keep the lang attribute because it's not a style class or inline style. But the instruction says "Use

  for introductory paragraphs and general text". It doesn't specify about lang. I think we can keep the lang attribute as it's harmless and preserves content. But the user might expect clean HTML without unnecessary attributes. The examples in the prompt didn't show any lang attributes. I'd lean to remove all attributes except maybe none. Actually, the instruction says "Return ONLY the HTML. No markdown fences, no explanation, no preamble." So we just output the HTML. I'll keep the lang attribute because it's part of the original content? The original had . If we remove the span, we lose the lang. But the text is English, so lang is not needed. I think we should drop the span tags entirely and just output the text inside

  . That's cleaner. The instruction says "Preserve ALL original content word-for-word". The content includes the text, not the markup. So we can output the text directly. I'll do that. Thus, first two paragraphs become:

  The Security Engineer – Vulnerability & EASM (External Attack Surface Management) owns the end-to-end identification, prioritization, and remediation of vulnerabilities across MTN’s internal estate and external-facing attack surface. MTN Group’s Security Operations Centre (SOC) is strengthening its proactive defense capability

  Beyond running the vulnerability management lifecycle, this is a forward-looking technical role that applies data analysis, threat intelligence, and emerging agentic-AI techniques to move the SOC from reactive patching to predictive, risk-driven exposure management.

  Then "Context" heading:

  Context

  Then a paragraph about MTN's Ambition 2030 strategy. That's a

  . Then another

  saying "The Group Information Security function must therefore ensure the successful delivery of its mandate in the context of:" then a list of 15 items. Each item is a

  ...

  . We need to convert that list to

  • ...

  . The original had

  . We'll just use
  without padding. Inside each li, there's a

  with the text. We can either keep the

  inside li or just put the text directly in li. The instruction says use

  • for list items. It doesn't specify if we need

    inside li. Typically, you can have

  • text
  or

  • text

  . To be safe, we can keep the

  inside li, but that might be redundant. The instruction says "Use

  • for list items (duties, requirements, qualifications, skills)". It doesn't say we must include

    inside li. I think we can just put the text directly in

  • . However, the original had

    tags inside li. To preserve word-for-word, we should keep the

    tags? But the instruction says "No CSS classes, no inline styles, no

    s, no
    tags". It doesn't forbid

    inside li. But it's redundant. I think we can simplify:

  • text
  . That's still preserving the content. The instruction says "Preserve ALL original content word-for-word". The content includes the text, not the tags. So we can output
  • text
  . That's fine. But note: some lists have multiple paragraphs inside li (like the 15 items each have a

  ). We can collapse to single

  • text
  . That's acceptable. After the list, there's a blank

  with margin. We can omit blank paragraphs or keep them? The instruction says preserve content, but blank paragraphs are not content. I think we can omit empty

  tags. But to be safe, we can keep them as

   

  ? That would add non-breaking spaces. Better to omit. The instruction says "If text has no clear sections, just wrap paragraphs in

  tags". Empty paragraphs are not needed. I'll omit them. Then the paragraph about intelligence, then "Values" heading, then several paragraphs about values, then "Live Y’ello" heading, then a list of five values. Then "Qualifications:" heading, then a list of six qualifications. Then "Preferred Certifications:" heading, then a list of two. Then "Technical Skills & Tools:" heading, then a list of seven. Then "Behavioural Competencies:" heading, then a list of five, but one item has two paragraphs (the last item has two

  tags). We need to combine them into one

  • or keep as two? The original had:
  • ...Collaborative, with the credibility to influence across teams and markets.
  • Self-driven thought leader who raises the capability of those around them.

  ...

  Actually, looking at the source:

  • Collaborative, with the credibility to influence across teams and markets.

  • Self-driven thought leader who raises the capability of those around them.

  So the second li contains two paragraphs. We can combine them into one
  • text
  or keep as two

  inside li. I think we can combine into one

  • Collaborative, with the credibility to influence across teams and markets. Self-driven thought leader who raises the capability of those around them.
  That preserves the words. Or we can keep as separate paragraphs inside li:

  • ...

    ...

  . That's fine too. I'll combine for simplicity. Then after that, there's a blank

  and then the main responsibilities section. The main responsibilities start with "The Security Engineer – Vulnerability & EASM (External Attack Surface Management) will be responsible for the following:" then a heading "Vulnerability Management (core)" then a list of four items. Then heading "External Attack Surface Management (EASM)" then a list (the list is cut off in the provided text, but we have the full text up to that point). We need to include everything. We need to output the entire cleaned HTML. Let's construct it carefully. I'll go through each piece: 1. Intro paragraphs:

  The Security Engineer – Vulnerability & EASM (External Attack Surface Management) owns the end-to-end identification, prioritization, and remediation of vulnerabilities across MTN’s internal estate and external-facing attack surface. MTN Group’s Security Operations Centre (SOC) is strengthening its proactive defense capability

  Note: The original had "&" which is HTML entity for &. In HTML output, we can write "&" or just "&". Since we are writing HTML, we should output "&" to represent &. But the instruction says preserve original content word-for-word. The original had "&" in the text. In HTML, "&" is the correct encoding for &. If we output "&", it would be interpreted as & character, which is also correct. But to be safe, we can output "&" as it appears. However, the user might expect clean HTML where & is represented as &. I'll keep "&" as in original. Similarly, later "&" appears. 2. Second intro paragraph:

  Beyond running the vulnerability management lifecycle, this is a forward-looking technical role that applies data analysis, threat intelligence, and emerging agentic-AI techniques to move the SOC from reactive patching to predictive, risk-driven exposure management.

  3. Heading:

  Context

  4. Paragraph:

  MTN's Ambition 2030 strategy is focused on leading digital solutions for Africa's progress by accelerating platform growth, advancing digital and financial inclusion, enabling sustainable connectivity, and building a resilient, future-fit organisation. As MTN continues its evolution into a digital platform business, Information Security plays a critical role in safeguarding customer trust, protecting digital services, enabling innovation, and ensuring operational resilience across MTN's diverse markets.

  5. Paragraph:

  The Group Information Security function must therefore ensure the successful delivery of its mandate in the context of:

  6. List of 15 items. Convert to
  • text
  ...
  . Each text is a sentence. We'll list them: - Supporting MTN's Ambition 2030 vision to be the leading platform business and digital solutions provider for Africa. - Accelerating digital transformation, cloud adoption, AI enablement, fintech expansion, digital services, and platform ecosystems across the Group. - Protecting MTN's rapidly expanding digital assets, customer data, financial platforms, and critical technology infrastructure. - Managing the geographic complexity of MTN's footprint across Africa and the Middle East, encompassing varying regulatory, political and cyber risk environments. - Maintaining stakeholder confidence by meeting the expectations of customers, shareholders, regulators, partners, and communities. - Enabling sustainable growth through secure digital innovation and the adoption of emerging technologies, including Artificial Intelligence. - Achieving operational excellence through standardised security processes, automation, intelligence-led decision-making, and continuous improvement. - Addressing an increasingly sophisticated and rapidly evolving cyber threat landscape targeting telecommunications operators, financial services, digital platforms, and critical infrastructure. - Ensuring business continuity, cyber resilience, and operational stability across a highly interconnected technology ecosystem. - Delivering integrated cyber defence capabilities across network, cloud, IT, digital, financial services, and enterprise environments. - Strengthening proactive threat intelligence, threat hunting, detection, response, and cyber risk management capabilities. - Supporting regulatory compliance and data protection requirements across multiple jurisdictions. - Enhancing MTN's reputation as a trusted, secure, and responsible digital operator. - Leveraging automation, machine learning, and AI-driven security capabilities to improve cyber defence effectiveness and operational efficiency. - Embedding a culture of security awareness, accountability, and resilience across MTN Group and its Operating Companies. 7. Blank paragraph omitted. 8. Paragraph:

  In this environment, the Information Security function is required to provide timely, actionable, and business-relevant intelligence that enables MTN to anticipate emerging threats, proactively manage cyber risks, and support the achievement of Ambition 2030 objectives.

  9. Heading:

  Values

  10. Paragraph:

  We at MTN are a purpose and value-led organization. At MTN, we believe that understanding our people’s needs and aspirations is key to creating experiences that delight you at work, everyday. We are committed to fostering an environment where every member of our Y’ello Family is heard, understood and empowered to live an inspired life.

  11. Paragraph:

  Our values keep us grounded and moving in the right direction. Most importantly, they keep us honest. It is not something we claim to be. It is in our DNA.

  12. Paragraph:

  As an organisation, we consider it our mission to create an exciting and rewarding place to work, where our people can be themselves, thrive in positivity and ignite their full potential. A workplace that boosts creativity and innovation, improves productivity, and ultimately drives meaningful results. A workplace that is built on relationships and achieving a purpose that is bigger than us.

  13. Paragraph:

  Our commitments go beyond an organisational promise. It is in our leadership and managerial ethos to meaningfully partner with our employees, customers and stakeholders with a vision to realise our shared goals.

  14. Blank omitted. 15. Heading:

  Live Y’ello

  16. List of five values: - Lead with Care - Can-do with Integrity - Collaborate with Agility - Serve with Respect - Act with Inclusion 17. Heading:

  Qualifications:

  18. List of six qualifications: - Bachelor’s degree in Computer Science, Information Security, Engineering or a related field – or equivalent practical experience. - 6+ years in information security, with at least 3–4 years dedicated to vulnerability management and/or attack surface management. - Demonstrable experience operating enterprise VM and EASM tooling at scale. - Hands-on scripting/automation (Python, PowerShell) and data analysis capability. - Proven track record of driving measurable risk-reduction and remediation outcomes. - Exposure to AI / agentic-AI tooling applied to security operations – strongly preferred 19. Heading:

  Preferred Certifications:

  20. List of two: - OSCP, GIAC (e.g., GWAPT, GEVA, GCTI), CISSP, CEH or equivalent. - Cloud security certifications (e.g., AZ-500, AWS Security Specialty, CCSP). 21. Heading:

  Technical Skills & Tools:

  (note &) 22. List of seven: - Vulnerability management: Tenable / Qualys or equivalent. - Attack surface management: Microsoft Defender EASM / Shodan or equivalent. - Prioritization frameworks: CVSS, EPSS, CISA KEV. - Threat frameworks: MITRE ATT&CK; threat-intelligence integration. - Cloud security: Azure / AWS / GCP exposure management. - Data & automation: Python, SQL, Power BI, SOAR / workflow automation. - AI: agentic-AI / LLM platforms (Anthropic Claude / Claude Code or equivalent); prompt and workflow design. 23. Heading:

  Behavioural Competencies:

  24. List of five, but last item combines two sentences. We'll make it one
  • : - Collaborative, with the credibility to influence across teams and markets. Self-driven thought leader who raises the capability of those around them. 25. Blank omitted. 26. Blank omitted.