Threat and Vulnerability Manager - Newport in Hyde

This role is for an experienced professional in vulnerability management and threat intelligence to join our Cyber Operations team. You will work closely with colleagues across the organisation to further mature and continuously improve our cyber defence capabilities. Cyber Operations forms part of a wider, well established security function operating within a highly regulated environment.

In this role, you will lead and continuously enhance the management of vulnerability assessments across our hybrid IT estate. You will prioritise remediation activities using a risk based, threat informed approach, collaborating with stakeholders to strengthen the security posture of our systems and services. You will also develop and mature our threat intelligence capability, identifying and maintaining relevant intelligence sources to inform tactical, operational, and strategic decision making. You will produce and share high quality threat intelligence products with internal and external stakeholders and use this intelligence to support vulnerability management and threat hunting activities. Additionally, you will contribute to incident response processes and provide support to colleagues responsible for the IPO's protection, detection, and response capabilities.

Main duties consist of but are not limited to:

• Vulnerability Management (Primary Focus)
  • Lead and enhance the organisation's vulnerability management programme, including our Penetration Testing programme across a complex hybrid IT environment covering both infrastructure and applications.
  • Prioritise vulnerabilities using a risk-based, threat-informed approach to support organisational objectives, regulatory requirements, and audit needs.
  • Oversee the full lifecycle of vulnerabilities, including triage, mitigation planning, remediation recommendations, and stakeholder coordination.
  • Develop and maintain vulnerability management policies, procedures, standards, and best practice guidance.
• Threat Intelligence
  • Produce high quality tactical, operational, and strategic intelligence assessments and briefings using analysis and interpretation of current threat intelligence.
  • Utilising and liaising with internal stakeholders, commercial sources, open-source intelligence and government partners to provide a rounded, comprehensive view of the current threat landscape.
  • Lead initiatives to strengthen the organisation's intelligence capability and participate in information sharing communities.
• Cyber Risk Management
  • Conduct risk and threat assessments aligned with regulations.
  • Provide pragmatic and proportionate advice and best practice guidance.
• Metrics & Reporting
  • Develop and maintain actionable metrics that demonstrate the effectiveness of the organisation's vulnerability management and threat intelligence capabilities.
• Incident Response Support
  • Contribute to and enhance our incident response processes, representing Cyber Security in operational incident calls.

Person specification

Essential Technical

• Strong understanding and experience of vulnerability management, threat intelligence and security operations within a complex enterprise environment.
• Experience of managing and developing penetration testing programs.
• Knowledge of secure development practices and where security testing for vulnerabilities fits into the Software Development Lifecycle (SDLC).
• Broad technical knowledge, especially around hybrid and cloud architectures, identity management and application security.

Essential Experience

• Highly organised and self-motivated, able to manage and deliver on multiple concurrent tasks.
• Excellent communication and interpersonal skills.
• Ability to interact with stakeholders of all levels with the ability to explain complex security concepts to non-technical audiences.
• A team player who is enthusiastic about contributing to the overall success of the team and collaborating with stakeholders of all levels.
• Sense of urgency and an ability to respond to tasks proactively and promptly.
• Continually stay abreast of emerging security technologies, threats and trends.
• Self-motivated to drive their learning needs.