Role Purpose

BCB is seeking a contractor to lead the establishment of a permanently owned Vulnerability Management capability. This role is the single accountable owner of vulnerability management. The successful candidate will design, stand up and run the business-as-usual (BAU) capability that prevents new technology debt from accumulating, and will define the operating relationship with the MSP and internal teams.

Key Accountabilities and Responsibilities

• Own the vulnerability management discipline end to end: policy, standards, process, cadence, exceptions and risk acceptance recommendations.
• Define and implement the target BAU operating model, including the responsibility split between the Bank and the MSP, and the closed-loop process in which patch deployment is independently verified by scanning.
• Direct the extension of authenticated scanning across the estate (including non-Windows assets and network devices), challenge and track MSP delivery plans and prerequisites, and drive scan coverage and depth to a defensible standard.
• Lead application estate rationalisation: establish the required application set, identify decommissioning candidates, and eliminate unjustified variants (for example, standardising the browser estate on an auto-updating standard).
• Select, scope and implement a third-party patching solution sized to the rationalised estate, and set differentiated patching policies by asset class (automatic updates for high-exposure commodity software; structured, vendor-engaged upgrade cycles for core platforms).
• Provide the technical substance for renegotiation of the MSP contract: patching remit, service levels, cadence, reporting, named owners and milestone dates.
• Define and report the measures of a functioning capability: mean time to remediate by severity, patch deployment rates, scan coverage and authentication depth, and validated closure rates. Contribute to a single consolidated remediation view for board reporting.
• Act as the receiving owner for workstreams completed by the technology debt remediation programme, ensuring each is sustained under BAU process rather than allowed to re-accumulate.