SL2502 - Vulnerability Management & Penetration Testing Lead

Role Overview

We are seeking an experienced Information Security professional to lead Vulnerability Management and Penetration Testing (VMPT) activities across the organisation.

The role covers three core areas: VMPT program management and governance, end-to-end vulnerability management, and penetration testing. The successful candidate will drive a risk-based approach to identifying, assessing, prioritising, and remediating security vulnerabilities across applications, infrastructure, and cloud environments.

Key Responsibilities

Program Management & Governance

• Build, manage, and continuously improve the Vulnerability Management and Penetration Testing (VMPT) program and capabilities.
• Develop and enhance policies, processes, standards, and procedures covering vulnerability management, penetration testing, communication, and reporting.
• Lead the triage and prioritisation of vulnerabilities and penetration testing findings based on threat exposure, compensating controls, business impact, and overall risk.
• Lead vulnerability and penetration testing governance forums, driving accountability and tracking remediation against defined SLAs.
• Escalate overdue, critical, or high-risk security findings to relevant stakeholders and management.
• Manage relationships with external vulnerability management and penetration testing vendors.
• Establish meaningful metrics and dashboards covering security posture, remediation progress, outstanding risks, and overall program effectiveness.
• Identify gaps in security processes and drive improvements using Risk-Based Vulnerability Management (RBVM) principles.
• Research, evaluate, and recommend appropriate vulnerability management and penetration testing tools.
• Produce clear technical reports and communicate complex security findings to both technical and non-technical stakeholders.
• Collaborate with cybersecurity teams and stakeholders on vulnerability management, penetration testing, and broader security initiatives.
• Mentor and provide technical guidance to junior security team members.
• Maintain security baseline governance using appropriate security tooling.
• Ensure security activities comply with applicable regulatory and organisational requirements.

Vulnerability Management

• Own and manage the end-to-end vulnerability management lifecycle from discovery and triage through remediation tracking, verification, and closure.
• Perform risk-based vulnerability assessments to determine actual exposure and remediation priorities.
• Identify gaps in vulnerability management processes and drive continuous improvement.
• Lead security reviews and monitoring of production environments across hybrid infrastructure.
• Track vulnerability remediation activities and ensure findings are addressed within established timelines.
• Support vulnerability verification and closure activities.
• Integrate relevant security and vulnerability information with SIEM and monitoring platforms where required.

Penetration Testing

• Own and manage the end-to-end penetration testing program, including scoping, rules of engagement, execution oversight, findings management, retesting, and closure.
• Develop and maintain an annual risk-based penetration testing plan.
• Coordinate penetration testing across external and internal networks, web applications, mobile applications, APIs, cloud environments, wireless environments, social engineering, and red/purple team exercises.
• Define and maintain penetration testing standards, methodologies, and rules of engagement.
• Apply recognised security frameworks and methodologies such as OWASP, PTES, NIST SP 800-115, and MITRE ATT&CK.
• Ensure appropriate quality, coverage, and independence of internally and externally delivered penetration testing.
• Review, triage, and validate penetration testing findings to determine severity, exposure, and remediation priorities.
• Retest remediated findings to confirm effective closure.
• Track security exceptions and residual risks through acceptance or resolution.
• Coordinate independent, threat-led, and scenario-based security testing where required.
• Ensure penetration testing activities meet applicable regulatory and industry requirements, including MAS Technology Risk Management (TRM) requirements.

Requirements

• Minimum 7 years of relevant information security or cybersecurity experience.
• Extensive experience in information security and/or IT risk management.
• Proven experience owning or managing vulnerability management and/or penetration testing programs.
• Strong experience establishing security governance processes and managing remediation activities.
• Strong hands-on experience with vulnerability management, penetration testing, and security engineering.
• Strong knowledge of Risk-Based Vulnerability Management (RBVM), including vulnerability triage and risk prioritisation.
• Experience identifying security risks associated with business processes, technology operations, applications, infrastructure, and technology projects.
• Experience with industry-standard vulnerability management, penetration testing, and Cloud Security Posture Management (CSPM) solutions.
• Strong hands-on penetration testing experience across network, web, mobile, API, and cloud environments.
• Experience managing external penetration testing vendors and validating security findings.
• Working knowledge of OWASP Testing Guide, PTES, NIST SP 800-115, and MITRE ATT&CK.
• Experience with offensive security tools such as Burp Suite, Nmap, Metasploit, Kali Linux, and Cobalt Strike.
• Working knowledge of scripting or programming languages such as Python, C++, Java, Ruby, Node.js, Go, or PowerShell.
• Experience with log configuration, log formats, and integration with SIEM platforms.
• Experience with process optimisation, automation, and ITSM workflow tools.
• Strong leadership, project management, and team-building capabilities.
• Ability to lead security initiatives involving multiple teams and departments.
• Strong communication and stakeholder management skills with the ability to communicate security risks to technical and non-technical audiences.

Education & Certifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related discipline is preferred.
• Professional certifications such as CISSP, CISM, CISA, or SANS/GIAC certifications are preferred.
• Penetration testing certifications such as OSCP, GPEN, GWAPT, CREST CRT/CCT, or CEH are preferred.
• Candidates without the preferred certification may be expected to obtain a relevant certification within the required timeframe.