Risk Management & Remediation

• Work with other technology teams to provide in-depth analysis of vulnerabilities and impacts to key stakeholders.
• Collaborate with application teams to ensure secure coding practices and timely remediation of vulnerabilities, aligned with criticality-based policy enforcement.
• Prioritise weaknesses in IT infrastructure and applications using manual and automated methods, including results from Static Application Testing (SAST) and Software Composition Analysis (SCA) tooling (in conjunction with the Service Transition team).
• Influence stakeholders to prioritise and drive remediation of process and technology gaps
• Work with Cyber Security, Application Teams, and IT Risk to ensure controls are met and vulnerabilities are addressed across infrastructure and applications.
• Engage and support Cyber Security for remediation of penetration test findings.
• Engage with Internal and External Auditors as the SME on all matters relating to VM.

Stakeholder Engagement & Culture

• Act as the primary Service Matter Expert and point of contact for the Threat and Vulnerability Management function within DES.
• Work closely with industry partners, vendors, and the wider technology ecosystem to leverage external expertise and best practices. Conduct market research to identify emerging risk and vulnerability trends.
• Build strong relationships across Bank and Securities functions (e.g. IT Risk & Control, Cyber Security, Operational Risk), underpinned by trust and core values.
• Lead by example in building relationships across the Bank, strengthening peer networks and collaboration.
• Promote values-led culture, fostering inclusivity and diversity.
• Champion staff cyber education and awareness to embed a proactive cyber-focused culture.
• Promote a dynamic, delivery-driven culture that works alongside Technology and Business units to provide responsive resolutions and value-driven solutions.

Your Profile

Skills and Experience

Leadership & Team Development

• Proven experience of directly managing a team of Threat and Vulnerability Engineers, including mentoring, developing, and guiding security professionals in a collaborative, high-performing environment.
• Strong strategic thinking and visionary skills with the ability to co-develop and drive the function’s technical vision, strategy, and roadmap aligned with business goals and risk appetite.

Technical Expertise & Security Operations

• Prior extensive experience working within infrastructure environments and cloud platforms (AWS, Azure, Oracle), with a high-level understanding of platforms, operating systems, and technologies.
• Proven capability in creating and executing comprehensive threat and vulnerability management programmes, including vulnerability scanning, penetration testing, and security awareness training.
• Proficiency in using vulnerability scanning tools (e.g. Tenable, Qualys, Rapid7, Veracode, JFrog Xray), threat intelligence platforms, and incident response tools.
• Prior experience implementing automated solutions for vulnerability scanning, threat detection, and incident response, with a focus on continuous process improvement.

Risk Management & Threat Intelligence

• Strong familiarity with security frameworks and standards (e.g. NIST, ISO 27001), and deep understanding of security concepts including vulnerability management, threat intelligence, incident response, and offensive security techniques.
• Experience in gathering and analysing threat intelligence to understand emerging threats, attack vectors, and threat actors. Maintains up-to-date knowledge of the latest security threats, vulnerabilities, and best practices.
• Strong analytical and problem-solving skills to analyse data, identify patterns and develop effective solutions to mitigate risk.

Communication & Stakeholder Engagement

• Proven ability to communicate effectively with senior management, providing governance and risk oversight.
• Excellent verbal and written communication skills to report findings and collaborate across cross-functional Technology and non-Technology teams.
• Ability to translate technical risks into business-relevant language for both technical and non-technical stakeholders, including executive leadership.

Education / Qualifications

Essential

• Recognised cybersecurity certification: CISSP and/or CISM
• Strong knowledge of:
  • Ivanti LANDesk, Qualys, Splunk
  • Windows Server/Desktop, RHEL/OEL Linux
  • PowerShell and Python scripting
• Proven experience leading strategic security initiatives and process automation in large-scale environments

Desirable

• Additional certifications: CCSP
• Familiarity with:
  • CyberArk PAM, ServiceNow SecOps Vulnerability Response / Application Vulnerability Response.
  • VMWare, Nutanix, Java VM
  • MSSQL, Oracle, MongoDB
  • Red Hat Satellite, Active Directory, LDAP, Kerberos
  • Confluence, JIRA
  • GDPR and SOX compliance frameworks