VULNERABILITY MANAGER (CYBER OPERATIONS)

Overview

We are seeking a highly experienced Vulnerability Manager (Cyber Operations) to be responsible for leading vulnerability management and cyber risk reduction activities across the NSOIT(D) products and services, while providing incident management support for significant cyber security events. This is a senior role based at MoD Corsham with on site working expected 3 days per week

Specific job skills

Vulnerability Management & Cyber Risk Reduction (70%)

• Own the NSOIT(D) Vulnerability Management Framework, policies, standards and procedure, including continual service improvements are integrated.
• Coordinate vulnerability discovery, assessment and prioritisation activities.
• Manage and optimise enterprise vulnerability assessment technologies including Clearswift, Tanium, Trend DSM, and Elastic.
• Coordinate remediation activities and track compliance against SLAs and KPIs, including MOD management processes.
• Produce dashboards, risk reports and executive briefings to support NSOIT(D) Cyber Vulnerability management outputs (e.g., Cyber Vulnerability Management Board (CVMB), Security Working Groups, etc).
• Support governance, compliance, accreditation and assurance activities within the Cyber Risk Management Board and VIGILANT.

Incident Management & Major Incident Support (20%)

• Support management and coordination of cyber security incidents affecting NSOIT(D).
• Lead technical assessment of vulnerability exploitation during major incidents.
• Support root cause analysis and post-incident reviews.
• Ensure incident findings are translated into remediation actions.

Security Monitoring, Threat Intelligence & Continuous Improvement (10%)

• Review significant security events where vulnerability exploitation is suspected.
• Correlate threat intelligence with vulnerability data.
• Support improvement of SIEM, SOAR and EDR capabilities.
• Contribute to cyber security metrics and continuous improvement initiatives.

Essential skills and experience

• Hold current DV clearance.
• Minimum 3 days on-site, with flexibility to support additional days when required for Major/Significant incident support.
• Significant experience operating and supporting enterprise vulnerability management systems and services.
• Experience with enterprise vulnerability scanning and management tools, including Clearswift, Tanium, Trend DSM, and Elastic, or equivalent.
• Strong understanding of CVSS, MOD Cyber Risk Management and remediation governance.
• Experience supporting cyber security incident management, within the MOD context.
• SANS 504 – Hacker Tools, Techniques, and Incident Handling

Desired skills and experience

• CompTIA Security+
• CompTIA CySA+
• ISC2 CISSP
• ISACA CISM
• CREST CPSA or CRT
• SANS 503 – Network Monitoring and Threat Detection In-Depth
• SANS 511 – Cybersecurity Engineering: Advanced Threat Detection and Monitoring

Eligibility Checks

Candidates must be DV cleared UK nationals.

Please note: We cannot accept any applications from candidates currently working on the Aurora framework unless the contract is due to finish within the next month.

Please note: For security reasons this role is open to sole UK nationals only. A ‘sole UK national’ refers to an individual who holds citizenship solely in the UK, without dual citizenship or nationality from another country. We do not offer visa sponsorship.