At a Glance
- Tasks: Lead vulnerability governance and drive risk management across digital platforms.
- Company: Join dmg media, a pioneer in popular journalism and innovative digital security.
- Benefits: Enjoy 25 days holiday, pension plan, discounts, and a supportive work environment.
- Other info: Diverse and inclusive workplace committed to professional growth.
- Why this job: Make a real impact on security while collaborating with top industry talent.
- Qualifications: Experience in vulnerability management and strong analytical skills required.
The predicted salary is between 70000 - 90000 £ per year.
Location: HSK, London
Contract Type: Full-time/Permanent
About Us
dmg media is the consumer media company of DMGT plc. Since the Daily Mail was first published in the closing stages of the 19th century, our brands have been pioneers of popular journalism, attracting the media industry’s best talent and reaching new audiences with new technologies. Throughout that time, dmg media’s brands have benefited from the stewardship of one family, holding fast to the editorial values that have made ours the most successful news media brands of the past century. Delivery of services to customers depends on being able to collect information, process it, and deliver content to customers, and above all, protect this information.
About the Role
We are seeking a Vulnerability Governance Lead to establish and drive a modern, risk-led vulnerability management capability. This role represents a deliberate shift away from traditional patch-focused security operations towards a governance, visibility, and accountability model. Rather than directly remediating vulnerabilities, this role will provide a centralised view of exposure across infrastructure, cloud, and applications, enabling and holding system owners accountable for remediation. Reporting to the Head of Cyber GRC, this individual will operate as a central authority on vulnerability risk, bringing clarity, prioritisation, and structure across multiple toolsets, including but not limited to Tenable, Wiz, and Snyk. This is a high-impact role suited to someone who combines technical depth with strong judgement, and who is comfortable influencing engineering teams and senior stakeholders to drive measurable risk reduction.
Main Responsibilities
- Exposure, Visibility & Risk Governance: Establish and maintain a unified view of vulnerability and exposure risk across infrastructure, cloud, and application environments using Tenable, Wiz, and Snyk. Correlate and prioritise vulnerabilities based on business context, including asset criticality, internet exposure, and data sensitivity. Define and maintain a risk-based vulnerability severity model, moving beyond CVSS to reflect real organisational risk.
- Ownership & Accountability Model: Drive a clear ownership model, ensuring all assets and services have defined system owners responsible for remediation. Shift accountability for vulnerability remediation to engineering, infrastructure, and product teams, while maintaining central oversight. Establish and enforce remediation SLAs aligned to risk severity.
- Governance Framework & Policy: Develop and maintain vulnerability management policies, standards, and procedures aligned to frameworks such as ISO 27001, NIST, and CIS. Design and operate a formal exception and risk acceptance process, including business justification, approval workflows, and expiry tracking. Ensure consistent application of governance across hybrid (on-prem and cloud) environments.
- Reporting, Metrics & Executive Visibility: Develop clear, actionable reporting for engineering and platform teams (operational view) and senior leadership and risk committees (strategic view). Track and report on SLA adherence, vulnerability ageing, exposure trends, and coverage across assets and environments. Provide regular updates to the security steering committee, highlighting risk, progress, and areas of concern.
- Tooling & Data Integration: Act as the central point of coordination for vulnerability tooling (Tenable, Wiz, Snyk), ensuring coverage across all environments, reduction of duplicate findings, and consistent data quality. Integrate outputs into ticketing and workflow systems (e.g., ServiceNow) to support remediation tracking. Drive improvements in automation for data aggregation, prioritisation, and reporting, not direct remediation.
- Collaboration & Enablement: Work closely with engineering, DevOps, and infrastructure teams to provide clear remediation guidance, reduce noise and false positives, and improve prioritisation of fixes. Support teams in embedding vulnerability management into development and operational workflows. Promote a culture of “you build it, you run it, you secure it.”
- Continuous Improvement: Stay current with emerging threats, vulnerabilities, and attack trends, and continuously evolve the programme. Identify gaps in coverage, tooling, or process, and drive improvements. Support penetration testing programmes by ensuring findings are tracked, governed, and remediated.
Person Specification
- Proven experience in vulnerability management or exposure management within complex, hybrid environments.
- Strong understanding of vulnerability tooling such as Tenable, Wiz, and/or Snyk, and how to interpret and correlate outputs.
- Experience designing or operating risk-based vulnerability governance programmes, including SLAs and exception handling.
- Solid understanding of security frameworks, including ISO 27001, NIST, and CIS.
- Experience working with engineering and platform teams to drive remediation outcomes without direct ownership.
- Strong analytical skills with the ability to translate technical findings into business risk language.
- Excellent communication and influencing skills, with confidence engaging senior stakeholders.
- Comfortable creating consolidated and compelling management reporting.
Why Join Us:
At dmg media, you will have the opportunity to work with some of the best talent in the industry and contribute to the security of our innovative digital platforms. We offer a collaborative and supportive work environment, competitive compensation, and opportunities for professional growth.
Package Description
Our benefits package increases the longer you’ve been with us. Here’s what to expect: 25 days’ holiday (increasing by 1 per year up to a total of 30). Upon joining you will be automatically enrolled onto the Pension Plan at the minimum level of 5% employee contribution, 3% Company Life cover under the Pension Plan of up to 3x your basic salary. DMGT Discounts (for discounts on online shopping, vouchers and reloadable cards). Subsidised canteen. Onsite gym (Northcliffe House only). Onsite nurse and GP clinics (Northcliffe House only). Our Employee Assistance Programme. Discounted dining cards. Plus many other benefits.
Our Commitment
We are committed to increasing diversity and maintaining an inclusive workplace culture. We welcome applications from all qualified candidates regardless of their ethnicity, race, gender, religious beliefs, sexual orientation, age, marital status, or disability. We are Disability Confident Committed. Please let us know if you require any recruitment documentation in other formats or if you require reasonable adjustments to be made during the recruitment process. Please be assured that any such information will be held separately to your recruitment application and will not be considered as part of the selection process.
Vulnerability Governance Lead in London employer: Dmg
At dmg media, we pride ourselves on fostering a collaborative and supportive work environment where innovation thrives. As a Vulnerability Governance Lead in London, you will not only contribute to the security of our cutting-edge digital platforms but also enjoy a competitive benefits package that grows with your tenure, including generous holiday allowances and professional development opportunities. Join us to work alongside some of the industry's best talent while being part of a company committed to diversity and inclusion.
StudySmarter Expert Advice🤫
We think this is how you could land Vulnerability Governance Lead in London
✨Tip Number 1
Network like a pro! Reach out to folks in your industry on LinkedIn or at events. A friendly chat can open doors that a CV just can't.
✨Tip Number 2
Prepare for interviews by researching the company and its culture. Tailor your answers to show how you fit into their vision, especially around vulnerability governance.
✨Tip Number 3
Practice makes perfect! Do mock interviews with friends or use online platforms. The more comfortable you are, the better you'll perform when it counts.
✨Tip Number 4
Don't forget to apply through our website! It’s the best way to ensure your application gets seen by the right people. Plus, we love seeing candidates who take that extra step!
We think you need these skills to ace Vulnerability Governance Lead in London
Some tips for your application 🫡
Tailor Your CV:Make sure your CV is tailored to the Vulnerability Governance Lead role. Highlight your experience with vulnerability management and any relevant tools like Tenable, Wiz, or Snyk. We want to see how your skills align with our needs!
Craft a Compelling Cover Letter:Your cover letter is your chance to shine! Use it to explain why you're passionate about vulnerability governance and how you can contribute to our team. Keep it concise but impactful – we love a good story!
Showcase Your Achievements:Don’t just list your responsibilities; showcase your achievements! Use metrics where possible to demonstrate how you've made a difference in previous roles. We’re all about measurable outcomes here at StudySmarter.
Apply Through Our Website:We encourage you to apply through our website for a smoother process. It helps us keep track of applications and ensures you don’t miss out on any important updates. Plus, it’s super easy!
How to prepare for a job interview at Dmg
✨Know Your Tools
Familiarise yourself with the vulnerability tools mentioned in the job description, like Tenable, Wiz, and Snyk. Be ready to discuss how you've used these tools in past roles and how they can be leveraged for effective vulnerability governance.
✨Understand Risk Governance
Brush up on risk-based vulnerability management concepts. Be prepared to explain how you would establish a unified view of vulnerability risk and prioritise vulnerabilities based on business context. This shows you understand the shift from traditional patching to a governance model.
✨Communicate Clearly
Since this role involves influencing engineering teams and senior stakeholders, practice articulating technical findings in business terms. Prepare examples of how you've successfully communicated complex information to non-technical audiences in the past.
✨Show Continuous Improvement Mindset
Demonstrate your commitment to staying current with emerging threats and vulnerabilities. Share any experiences where you've identified gaps in processes or tooling and driven improvements, showcasing your proactive approach to vulnerability management.
