Vulnerability Governance Lead in London

Location: HSK, London

Contract Type: Full-time/Permanent

About the Role

We are seeking a Vulnerability Governance Lead to establish and drive a modern, risk‑led vulnerability management capability. This role focuses on governance, visibility and accountability rather than direct remediation. The candidate will provide a centralised view of exposure across infrastructure, cloud and applications, enabling and holding system owners accountable for remediation.

Reporting to the Head of Cyber GRC, this individual will act as a central authority on vulnerability risk, bringing clarity, prioritisation and structure across multiple toolsets including but not limited to Tenable, Wiz and Snyk.

Main Responsibilities

• Establish and maintain a unified view of vulnerability and exposure risk across infrastructure, cloud and application environments using Tenable, Wiz and Snyk.
• Correlate and prioritise vulnerabilities based on business context, including asset criticality, internet exposure and data sensitivity.
• Define and maintain a risk‑based vulnerability severity model, moving beyond CVSS to reflect real organisational risk.
• Drive a clear ownership model, ensuring all assets and services have defined system owners responsible for remediation.
• Shift accountability for vulnerability remediation to engineering, infrastructure and product teams, while maintaining central oversight.
• Establish and enforce remediation SLAs aligned to risk severity.
• Develop and maintain vulnerability management policies, standards and procedures aligned to frameworks such as ISO 27001, NIST and CIS.
• Design and operate a formal exception and risk acceptance process, including business justification, approval workflows and expiry tracking.
• Ensure consistent application of governance across hybrid (on‑prem and cloud) environments.
• Develop clear, actionable reporting for engineering and platform teams (operational view) and senior leadership and risk committees (strategic view).
• Track and report on SLA adherence, vulnerability ageing, exposure trends and coverage across assets and environments.
• Provide regular updates to the security steering committee, highlighting risk, progress and areas of concern.
• Act as the central point of coordination for vulnerability tooling (Tenable, Wiz, Snyk), ensuring coverage across all environments, reduction of duplicate findings and consistent data quality.
• Integrate outputs into ticketing and workflow systems, e.g. ServiceNow, to support remediation tracking.
• Drive improvements in automation for data aggregation, prioritisation and reporting, not direct remediation.
• Work closely with engineering, DevOps and infrastructure teams to provide clear remediation guidance, reduce noise and false positives and improve prioritisation of fixes.
• Support teams in embedding vulnerability management into development and operational workflows.
• Promote a culture of "you build it, you run it, you secure it."
• Stay current with emerging threats, vulnerabilities and attack trends, continuously evolving the programme.
• Identify gaps in coverage, tooling or process and drive improvements.
• Support penetration testing programmes by ensuring findings are tracked, governed and remediated.

Person Specification

• Proven experience in vulnerability management or exposure management within complex, hybrid environments.
• Strong understanding of vulnerability tooling such as Tenable, Wiz and/or Snyk, and how to interpret and correlate outputs.
• Experience designing or operating risk‑based vulnerability governance programmes, including SLAs and exception handling.
• Solid understanding of security frameworks, including ISO 27001, NIST and CIS.
• Experience working with engineering and platform teams to drive remediation outcomes without direct ownership.
• Strong analytical skills with the ability to translate technical findings into business risk language.
• Excellent communication and influencing skills, with confidence engaging senior stakeholders.
• Comfortable creating consolidated and compelling management reporting.

Benefits

• 25 days' holiday (increasing by 1 per year up to a total of 30)
• Automatic enrollment on the Pension Plan at the minimum level of 5% employee contribution, 3% company contribution
• Life cover under the Pension Plan of up to 3x your basic salary
• DMGT Discounts for online shopping, vouchers and reloadable cards
• Subsidised canteen
• Onsite gym (Northcliffe House only)
• Onsite nurse and GP clinics (Northcliffe House only)
• Employee Assistance Programme
• Discounted dining cards

Commitment to Equality

We are committed to increasing diversity and maintaining an inclusive workplace culture. We welcome applications from all qualified candidates regardless of ethnicity, race, gender, religious beliefs, sexual orientation, age, marital status or disability. We are Disability Confident Committed. Please let us know if you require any recruitment documentation in other formats or reasonable adjustments during the recruitment process. Any such information will be held separately and will not be considered as part of the selection process.