About The Role

The role involves providing operational support for the end to end vulnerability management (VM) service. The vulnerability management service helps defend KPMG and its clients by ensuring scans of KPMG information assets are performed and pro-actively managing vulnerabilities in conjunction with Enterprise wide and Technology engineering teams, in alignment with KPMG risk objectives.

Work collaboratively with KPMG Engineering teams and internal stakeholders to provide risk based technical assessments on technical vulnerabilities;
Provide vulnerability remediation prioritisation recommendations to internal stakeholders and Engineering teams;
Maintain strong relationships with internal stakeholders and Engineering teams to ensure customer satisfaction, by delivering quality service and escalation issues as necessary;
Influence colleagues to drive vulnerability remediation in a collaborative manner to help achieve operational and strategic targets;
Perform review of any exception requests related to technical vulnerabilities, providing recommendations and documenting findings and actions;
Identify and drive vulnerability management service improvements, especially through the use of automation.
Collate and analyse data from internal stakeholders on technical vulnerabilities to support any information requests from leadership and or KPMG clients;
Support configuration and reporting requests within vulnerability management technology;
Work with vulnerability management technology vendors to support vulnerability management activities;
Attend and support internal and external audits from a vulnerability management service perspective;
Support investigations and resolutions of security problems to find a root cause and find a balanced outcome;
Provide analysis on trends and proactively drive remediation issues and areas of concern;
Maintain and update service documentation, such as process guides; and work instructions
Assist with reporting to leadership and other service stakeholders on service performance (against KPIs) and vulnerability risk exposure (against KRIs).
Provide advice to VM service owner on ways to improve control mechanisms, identify, evaluate, and mitigate risks;
Input to development of vulnerability management standards and security policies;
Work towards and achieve or extend professional certifications as part of personal development.

Prior experience

You must have

Strong relevant experience in a similar vulnerability management role;
Strong experience of configuring and operating Qualys vulnerability management tooling, including configuration and maintenance. Experience of operating Microsoft Defender and ServiceNow
Experience and knowledge in vulnerability management of applications and infrastructure within the Cloud, AWS, Azure and GCP;
Experience managing senior stakeholders;
Be able to demonstrate the ability to adapt communication style to explain technical concepts to different people within an organisation whether advising stakeholders, directing teams or sharing experience;
Experience of successfully working in a fast paced, customer service environment, delivering high quality information security services;

It would be advantageous if you can demonstrate some, or all of

Experience and knowledge of container or serverless platforms;
Any security or vulnerability management product certification.
Experience of working with BitSight or similar external security posture management system.