Vulnerability Management & Penetration Testing Lead - #1171640

Role Overview

We are seeking an experienced Information Security professional to lead Vulnerability Management and Penetration Testing (VMPT) activities across the organisation.

The role covers three core areas: VMPT program management and governance, end-to-end vulnerability management, and penetration testing. The successful candidate will drive a risk-based approach to identifying, assessing, prioritising, and remediating security vulnerabilities across applications, infrastructure, and cloud environments.

Key Responsibilities

Program Management & Governance

• Build, manage, and continuously improve the Vulnerability Management and Penetration Testing (VMPT) program and capabilities.
• Develop and enhance policies, processes, standards, and procedures covering vulnerability management, penetration testing, communication, and reporting.
• Lead the triage and prioritisation of vulnerabilities and penetration testing findings based on threat exposure, compensating controls, business impact, and overall risk.
• Lead vulnerability and penetration testing governance forums, driving accountability and tracking remediation against defined SLAs.
• Escalate overdue, critical, or high-risk security findings to relevant stakeholders and management.
• Manage relationships with external vulnerability management and penetration testing vendors.
• Establish meaningful metrics and dashboards covering security posture, remediation progress, outstanding risks, and overall program effectiveness.
• Identify gaps in security processes and drive improvements using Risk-Based Vulnerability Management (RBVM) principles.
• Research, evaluate, and recommend appropriate vulnerability management and penetration testing tools.
• Produce clear technical reports and communicate complex security findings to both technical and non-technical stakeholders.
• Collaborate with cybersecurity teams and stakeholders on vulnerability management, penetration testing, and broader security initiatives.
• Mentor and provide technical guidance to junior security team members.
• Maintain security baseline governance using appropriate security tooling.
• Ensure security activities comply with applicable regulatory and organisational requirements.

Vulnerability Management

• Own and manage the end-to-end vulnerability management lifecycle from discovery and triage through remediation tracking, verification, and closure.
• Perform risk-based vulnerability assessments to determine actual exposure and remediation priorities.
• Identify gaps in vulnerability management processes and drive continuous improvement.
• Lead security reviews and monitoring of production environments across hybrid infrastructure.
• Track vulnerability remediation activities and ensure findings are addressed within established timelines.
• Support vulnerability verification and closure activities.
• Integrate relevant security and vulnerability information with SIEM and monitoring platforms where required.

Penetration Testing

• Own and manage the end-to-end penetration testing program, including scoping, rules of engagement, execution oversight, findings management, retesting, and closure.
• Develop and maintain an annual risk-based penetration testing plan.
• Coordinate penetration testing across external and internal networks, web applications, mobile applications, APIs, cloud environments, wireless environments, social engineering, and red/purple team exercises.
• Define and maintain penetration testing standards, methodologies, and rules of engagement.
• Apply recognised security frameworks and methodologies such as OWASP, PTES, NIST SP 800-115, and MITRE ATT&CK.
• Ensure appropriate quality, coverage, and independence of internally and externally delivered penetration testing.
• Review, triage, and validate penetration testing findings to determine severity, exposure, and remediation priorities.
• Retest remediated findings to confirm effective closure.
• Track security exceptions and residual risks through acceptance or resolution.
• Coordinate independent, threat-led, and scenario-based security testing where required.
• Ensure penetration testing activities meet applicable regulatory and industry requirements, including MAS Technology Risk Management (TRM) requirements.

Requirements

• Minimum 7 years of relevant information security or cybersecurity experience.
• Extensive experience in information security and/or IT risk management.
• Proven experience owning or managing vulnerability management and/or penetration testing programs.
• Strong experience establishing security governance processes and managing remediation activities.
• Strong hands-on experience with vulnerability management, penetration testing, and security engineering.
• Strong knowledge of Risk-Based Vulnerability Management (RBVM), including vulnerability triage and risk prioritisation.
• Experience identifying security risks associated with business processes, technology operations, applications, infrastructure, and technology projects.
• Experience with industry-standard vulnerability management, penetration testing, and Cloud Security Posture Management (CSPM) solutions.
• Strong hands-on penetration testing experience across network, web, mobile, API, and cloud environments.
• Experience managing external penetration testing vendors and validating security findings.
• Working knowledge of OWASP Testing Guide, PTES, NIST SP 800-115, and MITRE ATT&CK.
• Experience with offensive security tools such as Burp Suite, Nmap, Metasploit, Kali Linux, and Cobalt Strike.
• Working knowledge of scripting or programming languages such as Python, C++, Java, Ruby, Node.js, Go, or PowerShell.
• Experience with log configuration, log formats, and integration with SIEM platforms.
• Experience with process optimisation, automation, and ITSM workflow tools.
• Strong leadership, project management, and team-building capabilities.
• Ability to lead security initiatives involving multiple teams and departments.
• Strong communication and stakeholder management skills with the ability to communicate security risks to technical and non-technical audiences.

Education & Certifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related discipline is preferred.
• Professional certifications such as CISSP, CISM, CISA, or SANS/GIAC certifications are preferred.
• Penetration testing certifications such as OSCP, GPEN, GWAPT, CREST CRT/CCT, or CEH are preferred.
• Candidates without the preferred certification may be expected to obtain a relevant certification within the required timeframe.