At a Glance
- Tasks: Lead vulnerability governance and drive risk management across digital platforms.
- Company: Join dmg media, a pioneer in popular journalism and innovative digital security.
- Benefits: Enjoy 25 days holiday, pension plan, discounts, and a supportive work environment.
- Other info: Diverse and inclusive workplace committed to professional growth.
- Why this job: Make a real impact on security while collaborating with top industry talent.
- Qualifications: Experience in vulnerability management and strong analytical skills required.
The predicted salary is between 70000 - 90000 £ per year.
Location: HSK, London
Contract Type: Full-time/Permanent
About Us
dmg media is the consumer media company of DMGT plc. Since the Daily Mail was first published in the closing stages of the 19th century, our brands have been pioneers of popular journalism, attracting the media industry’s best talent and reaching new audiences with new technologies. Throughout that time, dmg media’s brands have benefited from the stewardship of one family, holding fast to the editorial values that have made ours the most successful news media brands of the past century. Delivery of services to customers depends on being able to collect information, process it, and deliver content to customers, and above all, protect this information.
About the Role
We are seeking a Vulnerability Governance Lead to establish and drive a modern, risk-led vulnerability management capability. This role represents a deliberate shift away from traditional patch-focused security operations towards a governance, visibility, and accountability model. Rather than directly remediating vulnerabilities, this role will provide a centralised view of exposure across infrastructure, cloud, and applications, enabling and holding system owners accountable for remediation. Reporting to the Head of Cyber GRC, this individual will operate as a central authority on vulnerability risk, bringing clarity, prioritisation, and structure across multiple toolsets, including but not limited to Tenable, Wiz, and Snyk. This is a high-impact role suited to someone who combines technical depth with strong judgement, and who is comfortable influencing engineering teams and senior stakeholders to drive measurable risk reduction.
Main Responsibilities
- Exposure, Visibility & Risk Governance: Establish and maintain a unified view of vulnerability and exposure risk across infrastructure, cloud, and application environments using Tenable, Wiz, and Snyk. Correlate and prioritise vulnerabilities based on business context, including asset criticality, internet exposure, and data sensitivity. Define and maintain a risk-based vulnerability severity model, moving beyond CVSS to reflect real organisational risk.
- Ownership & Accountability Model: Drive a clear ownership model, ensuring all assets and services have defined system owners responsible for remediation. Shift accountability for vulnerability remediation to engineering, infrastructure, and product teams, while maintaining central oversight. Establish and enforce remediation SLAs aligned to risk severity.
- Governance Framework & Policy: Develop and maintain vulnerability management policies, standards, and procedures aligned to frameworks such as ISO 27001, NIST, and CIS. Design and operate a formal exception and risk acceptance process, including business justification, approval workflows, and expiry tracking. Ensure consistent application of governance across hybrid (on-prem and cloud) environments.
- Reporting, Metrics & Executive Visibility: Develop clear, actionable reporting for engineering and platform teams (operational view) and senior leadership and risk committees (strategic view). Track and report on SLA adherence, vulnerability ageing, exposure trends, and coverage across assets and environments. Provide regular updates to the security steering committee, highlighting risk, progress, and areas of concern.
- Tooling & Data Integration: Act as the central point of coordination for vulnerability tooling (Tenable, Wiz, Snyk), ensuring coverage across all environments, reduction of duplicate findings, and consistent data quality. Integrate outputs into ticketing and workflow systems (e.g., ServiceNow) to support remediation tracking. Drive improvements in automation for data aggregation, prioritisation, and reporting, not direct remediation.
- Collaboration & Enablement: Work closely with engineering, DevOps, and infrastructure teams to provide clear remediation guidance, reduce noise and false positives, and improve prioritisation of fixes. Support teams in embedding vulnerability management into development and operational workflows. Promote a culture of “you build it, you run it, you secure it.”
- Continuous Improvement: Stay current with emerging threats, vulnerabilities, and attack trends, and continuously evolve the programme. Identify gaps in coverage, tooling, or process, and drive improvements. Support penetration testing programmes by ensuring findings are tracked, governed, and remediated.
Person Specification
- Proven experience in vulnerability management or exposure management within complex, hybrid environments.
- Strong understanding of vulnerability tooling such as Tenable, Wiz, and/or Snyk, and how to interpret and correlate outputs.
- Experience designing or operating risk-based vulnerability governance programmes, including SLAs and exception handling.
- Solid understanding of security frameworks, including ISO 27001, NIST, and CIS.
- Experience working with engineering and platform teams to drive remediation outcomes without direct ownership.
- Strong analytical skills with the ability to translate technical findings into business risk language.
- Excellent communication and influencing skills, with confidence engaging senior stakeholders.
- Comfortable creating consolidated and compelling management reporting.
Why Join Us:
At dmg media, you will have the opportunity to work with some of the best talent in the industry and contribute to the security of our innovative digital platforms. We offer a collaborative and supportive work environment, competitive compensation, and opportunities for professional growth.
Package Description
Our benefits package increases the longer you’ve been with us. Here’s what to expect: 25 days’ holiday (increasing by 1 per year up to a total of 30). Upon joining you will be automatically enrolled onto the Pension Plan at the minimum level of 5% employee contribution, 3% Company Life cover under the Pension Plan of up to 3x your basic salary. DMGT Discounts (for discounts on online shopping, vouchers and reloadable cards). Subsidised canteen. Onsite gym (Northcliffe House only). Onsite nurse and GP clinics (Northcliffe House only). Our Employee Assistance Programme. Discounted dining cards. Plus many other benefits.
Our Commitment
We are committed to increasing diversity and maintaining an inclusive workplace culture. We welcome applications from all qualified candidates regardless of their ethnicity, race, gender, religious beliefs, sexual orientation, age, marital status, or disability. We are Disability Confident Committed. Please let us know if you require any recruitment documentation in other formats or if you require reasonable adjustments to be made during the recruitment process. Please be assured that any such information will be held separately to your recruitment application and will not be considered as part of the selection process.
Vulnerability Governance Lead in London employer: Dmg
At dmg media, we pride ourselves on fostering a collaborative and supportive work environment where innovation thrives. As a Vulnerability Governance Lead in London, you will not only contribute to the security of our cutting-edge digital platforms but also enjoy a competitive benefits package that grows with your tenure, including generous holiday allowances and professional development opportunities. Join us to work alongside some of the industry's best talent while being part of a company committed to diversity and inclusion.
StudySmarter Expert Advice🤫
We think this is how you could land Vulnerability Governance Lead in London
✨Get Involved in the Cybersecurity Community
Diving into the cybersecurity community is key for landing that full-time gig. Join forums like Reddit's r/cybersecurity or attend local meetups to connect with industry veterans and other job seekers. Networking is everything in this field—don’t just be a passive lurker!
✨Show Off Your Skills with Capture the Flag Competitions
Participate in Capture the Flag (CTF) competitions; these are not just a fun way to boost your skills but also a chance to showcase your talent to potential employers. Many companies, including Dmg, love seeing candidates who actively engage in these challenges.
✨Tailor Your Online Presence
Make sure your LinkedIn and any professional profiles reflect your cybersecurity expertise. Share your projects, whether they’re personal or from a previous role, to catch the eye of hiring managers. This is how they’ll find your passion and commitment to the field!
✨Apply Directly Through Dmg
Don’t forget to head straight to our website and check out any openings for cybersecurity roles at Dmg. Applying directly can sometimes give you an edge, especially if you can mention that you've been following our work or engaging in the community.
We think you need these skills to ace Vulnerability Governance Lead in London
Some tips for your application 🫡
Show off your technical skills:In cybersecurity, it's crucial to highlight your technical prowess. Make sure your CV showcases specific skills like network security, penetration testing, or threat analysis. If you have relevant certifications (like CEH or CISSP), pop those on the front page to grab attention!
Tailor your portfolio for the role:Even for a full-time role, a portfolio can set you apart. If you've worked on any cybersecurity projects—be it CTF challenges, security assessments, or research papers—include these in your application. This demonstrates not just your skills, but also your hands-on experience!
Use real-world examples:When writing your cover letter, don’t just stick to your qualifications. Share real-world examples of how you’ve tackled security issues or vulnerabilities. This gives the hiring team at Dmg insight into your practical problem-solving abilities and makes your application memorable.
Demonstrate your passion for cybersecurity:Cybersecurity is an ever-evolving field, so show us that you’re always learning! Mention any recent courses, webinars, or industry events you’ve attended. This not only exhibits your enthusiasm but also signals to Dmg that you’re committed to staying ahead in the game.
How to prepare for a job interview at Dmg
✨Sharpen Your Technical Skills
For a role in cybersecurity, it’s essential to be up-to-date with the latest tools and techniques. Brush up on your knowledge of firewalls, intrusion detection systems, and vulnerability assessment tools. Be ready to discuss specific scenarios where you’ve applied these skills, as hands-on experience can really set us apart in interviews.
✨Prepare for Scenario-Based Questions
Expect the interviewers at Dmg to throw in some hypothetical situations to see how you’d handle them. Think about common security breaches or incidents and be prepared to explain how you would respond. This not only shows your problem-solving skills but also your understanding of real-world cybersecurity challenges.
✨Highlight Your Certifications
Certifications like CompTIA Security+, CISSP, or CEH can give you a significant edge in a full-time role in cybersecurity. Make sure to mention these during your interview and be prepared to discuss what you learned through those certifications and how they relate to the position at Dmg.
✨Show Your Passion for Cybersecurity
Since you’re going for a full-time gig, showing genuine enthusiasm for the field can make all the difference. Share any personal projects, blogs, or communities you’re part of that relate to cybersecurity. This not only showcases your passion but also your commitment to staying engaged in this ever-evolving field.
