Vulnerability Governance Lead in London

dmg media is the consumer media company of DMGT plc. Since the Daily Mail was first published in the closing stages of the 19th century, our brands have been pioneers of popular journalism, attracting the media industry’s best talent and reaching new audiences with new technologies. Throughout that time, dmg media’s brands have benefited from the stewardship of one family, holding fast to the editorial values that have made ours the most successful news media brands of the past century. Delivery of services to customers depends on being able to collect information, process it, and deliver content to customers, and above all, protect this information.

About the Role

We are seeking a Vulnerability Governance Lead to establish and drive a modern, risk-led vulnerability management capability. This role represents a deliberate shift away from traditional patch-focused security operations towards a governance, visibility, and accountability model. Rather than directly remediating vulnerabilities, this role will provide a centralised view of exposure across infrastructure, cloud, and applications, enabling and holding system owners accountable for remediation. Reporting to the Head of Cyber GRC, this individual will operate as a central authority on vulnerability risk, bringing clarity, prioritisation, and structure across multiple toolsets, including but not limited to Tenable, Wiz, and Snyk. This is a high-impact role suited to someone who combines technical depth with strong judgement, and who is comfortable influencing engineering teams and senior stakeholders to drive measurable risk reduction.

Main Responsibilities

• Exposure, Visibility & Risk Governance
  • Establish and maintain a unified view of vulnerability and exposure risk across infrastructure, cloud, and application environments using Tenable, Wiz, and Snyk.
  • Correlate and prioritise vulnerabilities based on business context, including asset criticality, internet exposure, and data sensitivity.
  • Define and maintain a risk-based vulnerability severity model, moving beyond CVSS to reflect real organisational risk.
• Ownership & Accountability Model
  • Drive a clear ownership model, ensuring all assets and services have defined system owners responsible for remediation.
  • Shift accountability for vulnerability remediation to engineering, infrastructure, and product teams, while maintaining central oversight.
  • Establish and enforce remediation SLAs aligned to risk severity.
• Governance Framework & Policy
  • Develop and maintain vulnerability management policies, standards, and procedures aligned to frameworks such as ISO 27001, NIST, and CIS.
  • Design and operate a formal exception and risk acceptance process, including business justification, approval workflows, and expiry tracking.
  • Ensure consistent application of governance across hybrid (on-prem and cloud) environments.
• Reporting, Metrics & Executive Visibility
  • Develop clear, actionable reporting for engineering and platform teams (operational view) and senior leadership and risk committees (strategic view).
  • Track and report on SLA adherence, vulnerability ageing, exposure trends, and coverage across assets and environments.
  • Provide regular updates to the security steering committee, highlighting risk, progress, and areas of concern.
• Tooling & Data Integration
  • Act as the central point of coordination for vulnerability tooling (Tenable, Wiz, Snyk), ensuring coverage across all environments and reduction of duplicate findings.
  • Integrate outputs into ticketing and workflow systems (e.g., ServiceNow) to support remediation tracking.
  • Drive improvements in automation for data aggregation, prioritisation, and reporting, not direct remediation.
  • Work closely with engineering, DevOps, and infrastructure teams to reduce noise and false positives, improve prioritisation of fixes, and support teams in embedding vulnerability management into development and operational workflows.
  • Promote a culture of “you build it, you run it, you secure it.”
  • Stay current with emerging threats, vulnerabilities, and attack trends, and continuously evolve the programme.
  • Identify gaps in coverage, tooling, or process, and drive improvements.
  • Support penetration testing programmes by ensuring findings are tracked, governed, and remediated.

Person Specification

• Proven experience in vulnerability management or exposure management within complex, hybrid environments.
• Strong understanding of vulnerability tooling such as Tenable, Wiz, and/or Snyk, and how to interpret and correlate outputs.
• Experience designing or operating risk-based vulnerability governance programmes, including SLAs and exception handling.
• Solid understanding of security frameworks, including ISO 27001, NIST, and CIS.
• Experience working with engineering and platform teams to drive remediation outcomes without direct ownership.
• Strong analytical skills with the ability to translate technical findings into business risk language.
• Excellent communication and influencing skills, with confidence engaging senior stakeholders.
• Comfortable creating consolidated and compelling management reporting.

Why Join Us

At dmg media, you will have the opportunity to work with some of the best talent in the industry and contribute to the security of our innovative digital platforms. We offer a collaborative and supportive work environment, competitive compensation, and opportunities for professional growth.

Our Commitment

We are committed to increasing diversity and maintaining an inclusive workplace culture. We welcome applications from all qualified candidates regardless of their ethnicity, race, gender, religious beliefs, sexual orientation, age, marital status, or disability. We are Disability Confident Committed. Please let us know if you require any recruitment documentation in other formats or if you require reasonable adjustments to be made during the recruitment process. Please be assured that any such information will be held separately to your recruitment application and will not be considered as part of the selection process.