Description
PSIRT is responsible for managing product-related vulnerabilities and security issues. It focuses on identifying, validating, prioritizing, and coordinating the remediation of vulnerabilities in products or services.
PSIRT operates mainly in the “Am I Vulnerable” (AMI3A) domain, ensuring product security risks are understood and reduced before exploitation occurs.
Responsibilities
- Intake and triage vulnerability reports (internal/external)
- Validate and reproduce reported vulnerabilities
- Assess risk (exploitability, impact, exposure)
- Prioritize remediation using contextual models (e.g., RMS vs CVSS)
- Coordinate fixes with development teams
- Manage disclosure process (responsible disclosure, advisories)
- Communicate with researchers, customers, and stakeholders
- Track vulnerability lifecycle (discovery → remediation → closure)
- Maintain vulnerability database and reporting
Job Description
- Strong understanding of application security and vulnerability classes
- Experience with vulnerability assessment and exploitation techniques
- Ability to analyze code, architecture, and system behavior
- Familiarity with disclosure standards and coordination processes
- Experience working with developers on remediation
- Strong risk assessment and prioritization skills
- Ability to translate technical findings into business impact
SIRT Positioning:
- CSIRT → Handles attacks (Execution layer)
- PSIRT → Handles vulnerabilities (Prevention layer)
- TA-SIRT → Measures & improves effectiveness (Strategy layer)
The complete defensive model:
- PSIRT reduces exposure
- CSIRT handles active threats
- TA-SIRT ensures it all actually works