SC Vulnerability Management Lead CGEMJP00351666

Role Title: Vulnerability Management Lead

\n

Duration: contract to run until 31/03/2027

\n

Location: Inverness or Preston. Hybrid

\n

Rate: up to £644 p/d Umbrella inside IR35

\n

Clearance required: Sole UK Nationality with Active SC Clearance.

\n

Role purpose / summary

\n

he Senior Vulnerability Management Consultant operates within the Operational Integrator (OI) function and provides governance, leadership, assurance, and strategic oversight of vulnerability management across a complex multi-supplier environment.

\n

The role is responsible for ensuring suppliers manage vulnerabilities consistently, effectively, and in accordance with client policy, regulatory requirements, and risk appetite. Working across security, service management, supplier, and client governance functions, the consultant provides a consolidated view of vulnerability risk and drives continuous improvement across the vulnerability management lifecycle.

\n

This is a governance, assurance, and supplier management role and does not perform vulnerability scanning, penetration testing, exploit analysis, or technical remediation.

\n

Key Responsibilities:

\n

Vulnerability Management Governance

\n

\n
• Own and govern the vulnerability management framework across suppliers
\n
• Define and maintain:
\n
• Vulnerability classification standards
\n
• Risk-based prioritisation models
\n
• Remediation timelines
\n
• Exception management processes
\n
• Ensure alignment to client security policies and control requirements
\n
• Supplier Governance & Performance Management
\n
• Act as the primary OI lead for vulnerability management
\n
• Challenge, validate, and assure supplier vulnerability processes
\n
• Drive consistency in reporting, remediation, and evidence standards
\n
• Manage escalations relating to high-risk or overdue vulnerabilities
\n
• Risk Management & Prioritisation
\n

\n

Ensure suppliers apply risk-based prioritisation methodologies, including:

\n

\n
• CVSS
\n
• EPSS
\n
• Known Exploited Vulnerabilities (KEV)
\n
• Business criticality considerations
\n
• Maintain visibility of enterprise vulnerability exposure
\n
• Oversee risk acceptance and exception management activities
\n
• Reporting & Executive Visibility
\n
• Produce consolidated vulnerability risk reporting across suppliers
\n

\n

Provide insight into:

\n

\n
• Risk posture
\n
• Remediation effectiveness
\n
• Compliance performance
\n
• Emerging threat exposure
\n
• Support governance boards and client security leadership
\n
• Assurance & Evidence Management
\n
• Define vulnerability management evidence requirements
\n

\n

Ensure end-to-end traceability of:

\n

\n
• Identification
\n
• Prioritisation
\n
• Remediation
\n
• Validation
\n
• Support audits, assurance reviews, and compliance activities
\n
• Continuous Improvement
\n

\n

\n
• Identify trends, recurring weaknesses, and process improvement opportunities
\n
• Drive maturity improvements across supplier processes
\n
• Support optimisation of reporting, governance, and operating models
\n
• Contribute to security operating model evolution within the SIAM environment
\n

\n

Your skills and experience

\n

Essential

\n

\n
• Significant experience in Vulnerability Management, Cyber Governance, Security Operations Governance, or GRC roles
\n

\n

Strong understanding of:

\n

\n
• Vulnerability management lifecycle
\n
• Risk-based remediation approaches
\n
• Security governance frameworks
\n
• Experience operating within complex multi-supplier environments
\n
• Strong stakeholder management and supplier challenge capability
\n
• Experience presenting risk information to senior stakeholders
\n

\n

Desirable

\n

Knowledge of:

\n

\n
• NIST CSF
\n
• NCSC guidance
\n
• ISO 27001
\n
• Secure by Design principles
\n
• Experience in Defence, Government, or highly regulated environments
\n
• Exposure to security assurance and audit activities
\n

\n

Key Deliverables

\n

\n
• Vulnerability Management Framework
\n
• Consolidated supplier vulnerability reporting
\n
• Executive vulnerability risk dashboards
\n
• Vulnerability governance and assurance packs
\n
• Continuous improvement roadmap
\n
• Audit-ready evidence repository
\n

\n

Role Definition

\n

The role governs and assures vulnerability management across suppliers, ensuring vulnerabilities are consistently prioritised, remediated, evidenced, and reported to the client through a risk-based and audit-ready approach, without performing technical remediation activities.

\n

What This Role Does / Does Not Do

\n

Does

\n

\n
• Govern, assure, challenge and coordinate
\n
• Provide enterprise-wide vulnerability risk visibility
\n
• Drive supplier accountability
\n
• Support risk-informed decision making
\n

\n

Does Not

\n

\n
• Operate vulnerability scanners
\n
• Perform technical security testing
\n
• Deploy patches or fixes
\n
• Own remediation engineering activities
\n

\n

All profiles will be reviewed against the required skills and experience. Due to the high number of applications we will only be able to respond to successful applicants in the first instance. We thank you for your interest and the time taken to apply!

\n

If you receive suspicious outreach claiming to be from us, please contact us via the ManpowerGroup website.

\n
\n

JBRP1_UKTJ