Vice President, Vulnerability Management Lead in City of Westminster

Vulnerability Management Lead to oversee and execute the end-to-end vulnerability management program for the EMEA region within a global financial institution. The role requires strong hands-on experience in vulnerability scanning, policy compliance, and the ServiceNow SecOps Vulnerability Response (VR) module, along with proven leadership in managing hybrid teams.

Responsibilities

• Lead EMEA vulnerability management and policy compliance lifecycle: scanning, prioritization, reporting, and remediation governance.
• Perform hands-on vulnerability analysis across infrastructure, cloud, and applications.
• Provide comprehensive solutions to complex problems, lead major initiatives in risk reduction surrounding vulnerabilities.
• Manage and guide offshore vulnerability analysts, ensuring high-quality and timely delivery.
• Operate and enhance ServiceNow SecOps VR workflows, dashboards, and automation.
• Ensure compliance with internal security policies and EMEA regulatory requirements (e.g., EBA, DORA, FCA).
• Liaise with other information security functions within the MUS international business and MUFG group to ensure a consistent approach to all controls, standards, and policies is adopted across the organisation.
• Collaborate with IT and application teams globally to drive remediation and risk reduction.
• Support the relationship and associated reporting requirements between Technology and internal and external bodies e.g. auditors, management committees, Tokyo head office, regulators (via Compliance), Operational Risk.
• Provide reporting, KPIs, and executive visibility on vulnerability posture.
• Support audits, risk assessments, and emerging vulnerability (zero-day) response.

Qualifications

• Proven experience (10+ years) in Vulnerability Management & Policy Compliance.
• Hands-on experience with ServiceNow SecOps VR module.
• Deep understanding of cybersecurity frameworks, governance, and risk management practices.
• Strong understanding of CVE/CVSS, threat intelligence, and remediation workflows.
• Experience managing offshore/onshore teams.
• Excellent communication and stakeholder management skills.
• Background in financial services or regulated environments preferred.
• Relevant certifications (CISSP, CISM, Security+, ServiceNow SecOps) are a plus.
• Experience as a Vulnerability Management & Policy Compliance SME.
• Understanding of Vulnerability Management principles.
• Understanding of Risk Assessment Methodologies.
• Knowledge of industry standard scoring models such as CVSS (Common Vulnerability Scoring System) or CCSS (Common Configuration Scoring System).
• Knowledge of industry standard data models such as CPE (Collection Processing Engine) and data normalization tools.
• Process oriented with keen attention to detail.
• Knowledge of common vulnerabilities, attack vectors, and mitigation techniques.
• Ability to proactively anticipate problems and execute solutions at a strategic level.
• Wide knowledge of application and IT products, interoperability, and extensive knowledge of IT security.
• Knowledge of application development platforms.
• Knowledge of vulnerability attack methods, exploit results, attack chains.
• Ability to think strategically.
• Active involvement in internal and external audits and experience of managing Audit relationships.

Education / Qualifications:

• Degree educated and/or equivalent experience.

Personal requirements

• Excellent communication skills.
• Results driven, with a strong sense of accountability.
• A proactive, motivated approach.
• The ability to operate with urgency and prioritise work accordingly.
• Strong decision making skills, the ability to demonstrate sound judgement.
• A structured and logical approach to work.
• Strong problem solving skills.
• A creative and innovative approach to work.
• Excellent interpersonal skills.
• The ability to manage large workloads and tight deadlines.
• Excellent attention to detail and accuracy.
• A calm approach, with the ability to perform well in a pressurised environment.

We are open to considering flexible working requests in line with organisational requirements.