Vulnerability Manager

Vulnerability Manager The Vulnerability Manager is responsible for governing, continually improving and driving effective management of Vulnerability Management capability. The role partners closely with Security, Technology, Risk, business stakeholders and 3rd parties to ensure vulnerabilities affecting applications, infrastructure, cloud services and third-party environments are identified, assessed, prioritised, remediated and reported in accordance with risk appetite and regulatory obligations. The Vulnerability Manager will provide pragmatic guidance, governance and oversight across the end-to-end vulnerability lifecycle, ensuring that vulnerabilities are managed consistently across the enterprise through effective policies, standards, procedures, reporting and controls. You will bring a strong understanding of cyber security risk, technical ability to understand vulnerabilities and proposed resolution, governance and vulnerability management practices, enabling you to effectively communicate technical risks to both business and technology audiences. You will be accountable for driving remediation outcomes, coordinating stakeholders, improving vulnerability management maturity and providing accurate reporting to senior management and governance committees. Your focus will be 7 primary pillars: Vulnerability Governance: Refine and maintain the frameworks, standards, procedures and governance structures required to effectively manage vulnerabilities across the enterprise. Ensure vulnerability management activities align with risk appetite, policies, ISO27001 requirements, industry best practice and applicable regulatory obligations. Vulnerability Identification & Assessment: Oversee the identification, technical analysis, validation and assessment of vulnerabilities across infrastructure, endpoints, cloud services, applications and third-party platforms. Ability to understand the technical depth of the vulnerabilities and proposed resolution. Analyse the impact, assess the technical requirements, and guide the relevant team on a possible resolution or a sound workaround to mitigate the risk. Ensure consistent risk-based prioritisation methodologies are applied. Vulnerability Lifecycle Management: Manage the end-to-end vulnerability management lifecycle including detection, triage, prioritisation, remediation tracking, exception management, validation and closure activities. Reporting & Metrics: Develop and maintain meaningful management reporting, operational dashboards and executive reporting that provide visibility of vulnerability exposure, remediation performance, ageing, trends and control effectiveness. Stakeholder Engagement: Partner with technology and business stakeholders to drive accountability for remediation activities, ensuring clear ownership, timelines and escalation pathways are established. Continuous Improvement: Identify opportunities to improve processes, tooling, automation, reporting and governance practices that enhance overall vulnerability management capability and cyber resilience. Tooling : Ensure appropriate vulnerability management tools and processes are in place and operating effectively to identify vulnerabilities and ensure their remediation. Responsibilities: Develop, maintain and enhance Vulnerability Management Framework and supporting processes. Review and enhance policies, standards and procedures related to vulnerability governance. Govern remediation obligations across business units and technology teams, with all systems in scope, including those provided via 3rd parties Manage risk acceptance, treatment and exception processes related to vulnerability management. Maintain alignment with ISO27001, NIST, internal policies and risk appetite in relation to vulnerability management. Deliver governance reporting to leadership, Technology and Business teams to ensure ongoing visibility, exception reporting and escalation is effective in relation to vulnerability management. Oversee vulnerability scanning tools and processes across applications, infrastructure, endpoints, cloud services and third-party environments. Validate, classify and assess identified vulnerabilities. Coordinate vulnerability triage activities with technology owners and service providers. Establish prioritisation criteria, remediation targets and escalation pathways. Track remediation progress through to retesting and verified closure. prioritisation Maintain vulnerability registers and evidence of closure/re-testing. Proactively work with internal and 3rd party teams to pragmatically prioritise vulnerability-related investigation/ remediation activities, including consideration for how resource augmentation could be used selectively to maintain momentum in remediation activities Develop and enhance existing operational, management and executive vulnerability dashboards and reporting. Report vulnerability exposure, remediation trends, ageing and exception status. Produce inputs for Technology, Risk, Security and executive governance forums. Monitor control effectiveness and identify recurring vulnerability themes such as obsolescence. Provide clear insights to support prioritisation and risk-based decision making. Build strong relationships across Technology, Security, Risk, Business and 3rd party teams. Coordinate vulnerability prioritization and remediation activities with system, application and platform owners. Facilitate vulnerability review forums and remediation planning discussions. Influence risk-based decision making and timely remediation outcomes. Educate stakeholders on vulnerability management requirements and accountabilities. Provide education, guidance and advice in relation to vulnerability management to stakeholders Track emerging industry trends, tools and risks in relation to vulnerability management and ensure these are highlighted and addressed. Identify opportunities to improve vulnerability management processes and controls. Enhance automation, workflow, reporting and tooling capabilities. Support cyber maturity uplift and audit remediation initiatives. Evaluate market trends and emerging practices in vulnerability management. Recommend strategic improvements to vulnerability governance and operational effectiveness. Speak up about risks Take ownership of risk Identify and manage risks early Challenge when something does not seem right Learn from mistakes and focus on long-term solutions Required experience: 5+ years’ experience in cyber security 3+ years’ experience in vulnerability management and/or information security governance. Demonstrated experience managing enterprise vulnerability management programs or remediation governance. Strong understanding of vulnerability assessment methodologies and risk prioritisation. Experience delivering executive and governance reporting. Strong written, verbal and presentation skills. Ability to structure and present concise, fact-based findings to senior stakeholders. For more information, please apply now or reach out to Oliver on [email protected] or 0455 198 736 .