Bermuda Commercial Bank
Vulnerability Management Modernisation Lead
Remote
Posted 2 days ago
Get notified of more jobs like this · No spam, ever
How your CV stacks up
1Upload CV
2Analyse CV
3Improve CV
Upload your CV to see how well it fits this job role
?%
Role Purpose
BCB is seeking a contractor to lead the establishment of a permanently owned Vulnerability Management capability. This role is the single accountable owner of vulnerability management. The successful candidate will design, stand up and run the business-as-usual (BAU) capability that prevents new technology debt from accumulating, and will define the operating relationship with the MSP and internal teams.
Key Accountabilities and Responsibilities
- Own the vulnerability management discipline end to end: policy, standards, process, cadence, exceptions, and risk acceptance recommendations.
- Define and implement the target BAU operating model: including the responsibility split between the Bank and the MSP, and the closed-loop process in which patch deployment is independently verified by scanning.
- Direct the extension of authenticated scanning across the estate: including non-Windows assets and network devices, challenge and track MSP delivery plans and prerequisites, and drive scan coverage and depth to a defensible standard.
- Lead application estate rationalisation: establish the required application set, identify decommissioning candidates, and eliminate unjustified variants (for example, standardising the browser estate on an auto-updating standard).
- Select, scope, and implement a third-party patching solution: sized to the rationalised estate, and set differentiated patching policies by asset class (automatic updates for high-exposure commodity software; structured, vendor-engaged upgrade cycles for core platforms).
- Provide the technical substance for renegotiation of the MSP contract: patching remit, service levels, cadence, reporting, named owners, and milestone dates.
- Define and report the measures of a functioning capability: mean time to remediate by severity, patch deployment rates, scan coverage and authentication depth, and validated closure rates. Contribute to a single consolidated remediation view for board reporting.
- Act as the receiving owner for workstreams completed by the technology debt remediation programme: ensuring each is sustained under BAU process rather than allowed to re-accumulate.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Experience, Skills & Attributes
- Demonstrable experience: establishing or running a vulnerability management function, ideally in a regulated financial services environment.
- Deep practical knowledge: of vulnerability scanning platforms, including the material difference between authenticated and unauthenticated scanning and the operational prerequisites of each (credentials, PAM integration, scan job configuration).
- Hands-on experience with enterprise patch management tooling: for both first-party and third-party software, including tool selection and implementation.
- The technical judgement: to distinguish genuine risk from scanner noise, and to apply a differentiated risk calculus across asset classes.
- Experience of estate rationalisation and decommissioning: as a remediation strategy — the instinct to ask “what can we switch off?” before “what can we patch?”.
- Track record of holding third-party suppliers to account: defining remits, SLAs, cadences, and delivery plans, and challenging dates that lack supporting plans.
- Ability to communicate exposure, progress, and trade-offs credibly: to senior and board-level audiences, including pre-briefing counterintuitive movements in reported numbers.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Would be an Asset to Have…
- Experience of core banking platform upgrade and remediation cycles: and of building rolling vendor-engaged upgrade models.
- Familiarity with secure configuration review and penetration testing: and integrating their findings into a single remediation backlog.
- Experience operating alongside, and handing off to or from, a formal remediation programme.
Trusted by 25,000+ job seekers
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Vulnerability Management
Patch Management
Risk Assessment
IT Security
Vendor Management
Estate Rationalisation
Authenticated Scanning
Technical Leadership
Compliance
Infrastructure Security
Stakeholder Management
Policy Development
Remediation Strategy
Cybersecurity
Technology Debt Management
Location