At a Glance
- Tasks: Lead vulnerability governance and drive risk-led management across diverse environments.
- Company: Dynamic tech firm committed to security and innovation.
- Benefits: 25 days holiday, pension plan, discounts, onsite gym, and more.
- Other info: Inclusive workplace culture with a commitment to diversity.
- Why this job: Shape the future of cybersecurity while making a real impact.
- Qualifications: Experience in vulnerability management and strong analytical skills required.
The predicted salary is between 60000 - 75000 £ per year.
Location: HSK, London
Contract Type: Full-time/Permanent
About the Role
We are seeking a Vulnerability Governance Lead to establish and drive a modern, risk‑led vulnerability management capability. This role focuses on governance, visibility and accountability rather than direct remediation. The candidate will provide a centralised view of exposure across infrastructure, cloud and applications, enabling and holding system owners accountable for remediation. Reporting to the Head of Cyber GRC, this individual will act as a central authority on vulnerability risk, bringing clarity, prioritisation and structure across multiple toolsets including but not limited to Tenable, Wiz and Snyk.
Main Responsibilities
- Establish and maintain a unified view of vulnerability and exposure risk across infrastructure, cloud and application environments using Tenable, Wiz and Snyk.
- Correlate and prioritise vulnerabilities based on business context, including asset criticality, internet exposure and data sensitivity.
- Define and maintain a risk‑based vulnerability severity model, moving beyond CVSS to reflect real organisational risk.
- Drive a clear ownership model, ensuring all assets and services have defined system owners responsible for remediation.
- Shift accountability for vulnerability remediation to engineering, infrastructure and product teams, while maintaining central oversight.
- Establish and enforce remediation SLAs aligned to risk severity.
- Develop and maintain vulnerability management policies, standards and procedures aligned to frameworks such as ISO 27001, NIST and CIS.
- Design and operate a formal exception and risk acceptance process, including business justification, approval workflows and expiry tracking.
- Ensure consistent application of governance across hybrid (on‑prem and cloud) environments.
- Develop clear, actionable reporting for engineering and platform teams (operational view) and senior leadership and risk committees (strategic view).
- Track and report on SLA adherence, vulnerability ageing, exposure trends and coverage across assets and environments.
- Provide regular updates to the security steering committee, highlighting risk, progress and areas of concern.
- Act as the central point of coordination for vulnerability tooling (Tenable, Wiz, Snyk), ensuring coverage across all environments, reduction of duplicate findings and consistent data quality.
- Integrate outputs into ticketing and workflow systems, e.g. ServiceNow, to support remediation tracking.
- Drive improvements in automation for data aggregation, prioritisation and reporting, not direct remediation.
- Work closely with engineering, DevOps and infrastructure teams to provide clear remediation guidance, reduce noise and false positives and improve prioritisation of fixes.
- Support teams in embedding vulnerability management into development and operational workflows.
- Promote a culture of 'you build it, you run it, you secure it.'
- Stay current with emerging threats, vulnerabilities and attack trends, continuously evolving the programme.
- Identify gaps in coverage, tooling or process and drive improvements.
- Support penetration testing programmes by ensuring findings are tracked, governed and remediated.
Person Specification
- Proven experience in vulnerability management or exposure management within complex, hybrid environments.
- Strong understanding of vulnerability tooling such as Tenable, Wiz and/or Snyk, and how to interpret and correlate outputs.
- Experience designing or operating risk‑based vulnerability governance programmes, including SLAs and exception handling.
- Solid understanding of security frameworks, including ISO 27001, NIST and CIS.
- Experience working with engineering and platform teams to drive remediation outcomes without direct ownership.
- Strong analytical skills with the ability to translate technical findings into business risk language.
- Excellent communication and influencing skills, with confidence engaging senior stakeholders.
- Comfortable creating consolidated and compelling management reporting.
Benefits
- 25 days' holiday (increasing by 1 per year up to a total of 30)
- Automatic enrollment on the Pension Plan at the minimum level of 5% employee contribution, 3% company contribution
- Life cover under the Pension Plan of up to 3x your basic salary
- DMGT Discounts for online shopping, vouchers and reloadable cards
- Subsidised canteen
- Onsite gym (Northcliffe House only)
- Onsite nurse and GP clinics (Northcliffe House only)
- Employee Assistance Programme
- Discounted dining cards
Commitment to Equality
We are committed to increasing diversity and maintaining an inclusive workplace culture. We welcome applications from all qualified candidates regardless of ethnicity, race, gender, religious beliefs, sexual orientation, age, marital status or disability. We are Disability Confident Committed. Please let us know if you require any recruitment documentation in other formats or reasonable adjustments during the recruitment process. Any such information will be held separately and will not be considered as part of the selection process.
Vulnerability Governance Lead employer: Dmgmedia
As a Vulnerability Governance Lead at our London location, you will thrive in a dynamic work culture that prioritises innovation and accountability. We offer a comprehensive benefits package, including generous holiday allowances, a robust pension plan, and access to onsite facilities like a gym and health clinics, all designed to support your well-being and professional growth. Join us to be part of a diverse team committed to fostering an inclusive environment where your contributions are valued and your career can flourish.
StudySmarter Expert Advice🤫
We think this is how you could land Vulnerability Governance Lead
✨Tip Number 1
Network like a pro! Reach out to folks in your industry on LinkedIn or at events. A friendly chat can open doors that a CV just can't.
✨Tip Number 2
Prepare for interviews by researching the company and its culture. Tailor your answers to show how you fit into their vision, especially around vulnerability governance.
✨Tip Number 3
Practice makes perfect! Do mock interviews with friends or use online platforms. The more comfortable you are, the better you'll perform when it counts.
✨Tip Number 4
Don't forget to apply through our website! It’s the best way to ensure your application gets seen by the right people. Plus, we love seeing familiar faces!
We think you need these skills to ace Vulnerability Governance Lead
Some tips for your application 🫡
Tailor Your Application:Make sure to customise your CV and cover letter to highlight your experience with vulnerability management and the specific tools mentioned, like Tenable, Wiz, and Snyk. We want to see how your skills align with our needs!
Showcase Your Governance Skills:Since this role is all about governance and accountability, be sure to include examples of how you've established or maintained governance frameworks in previous roles. We love seeing clear, structured approaches!
Communicate Clearly:Your ability to translate technical jargon into business risk language is crucial. Use your application to demonstrate your communication skills, especially when engaging with senior stakeholders. We appreciate clarity and conciseness!
Apply Through Our Website:We encourage you to apply directly through our website for a smoother process. It helps us keep track of your application and ensures you don’t miss out on any important updates from us!
How to prepare for a job interview at Dmgmedia
✨Know Your Tools Inside Out
Make sure you’re well-versed in the vulnerability tools mentioned in the job description, like Tenable, Wiz, and Snyk. Familiarise yourself with how they work, their outputs, and how to correlate findings. This will show that you can hit the ground running.
✨Speak Their Language
When discussing your experience, use terminology that aligns with the role's focus on risk-based governance and accountability. Be ready to explain how you've previously prioritised vulnerabilities based on business context and asset criticality.
✨Demonstrate Your Governance Skills
Prepare examples of how you've established or maintained governance frameworks in past roles. Highlight your experience with security standards like ISO 27001, NIST, and CIS, and be ready to discuss how you’ve driven accountability for remediation in hybrid environments.
✨Showcase Your Communication Prowess
Since this role involves engaging with senior stakeholders, practice articulating complex technical concepts in a way that’s easy to understand. Bring examples of how you’ve created compelling management reports or communicated risk effectively to non-technical audiences.
