Vulnerability Management Security Sr. Analyst

What success looks like in this role: Vulnerability Assessment & Scanning Plan, schedule, and execute vulnerability scans across network, endpoint, server, and cloud environments using tools such as Nessus, Qualys, Rapid7 InsightVM, or Microsoft Defender Vulnerability Management. Perform authenticated and unauthenticated scans, ensuring coverage across all in-scope assets. Conduct ad hoc scans following remediation activities to validate closure of identified vulnerabilities. Maintain and continuously improve scan coverage, ensuring no asset gaps in the vulnerability programme. Analysis & Risk Prioritisation Analyse scan results and assess vulnerabilities based on CVSS scores, exploit availability, asset criticality, and business impact. Correlate vulnerability findings with threat intelligence feeds to identify actively exploited vulnerabilities that require expedited remediation. Differentiate and prioritise Critical, High, Medium, and Low severity vulnerabilities in line with client SLAs and organisational risk appetite. Provide contextual risk analysis beyond automated scoring, considering the environment and compensating controls in place. Remediation Management & Follow-up Assign remediation tasks to relevant resolver teams and track progress through to closure. Conduct regular follow-up with resolver teams to ensure patch deployment, configuration changes, or compensating controls are applied within agreed timelines. Escalate overdue or high-risk items to management and client stakeholders as appropriate. Validate remediation completeness through rescan confirmation and update records accordingly. Reporting & Governance Prepare and deliver monthly, weekly, and ad hoc vulnerability management reports for client and internal stakeholders, including trend analysis, SLA performance, and risk posture summaries. Maintain accurate and up-to-date vulnerability records across ticketing and vulnerability management platforms. Support governance meetings, monthly business reviews, and audit activities with relevant vulnerability data and evidence. Track and report on KPIs such as mean time to remediate (MTTR), vulnerability age, and scan coverage. Client & Stakeholder Engagement Act as a point of contact for client queries related to vulnerability findings, remediation status, and risk assessment. Provide guidance and recommendations to resolver teams and clients on remediation approaches, patch management, and risk acceptance. Participate in client calls and governance forums, presenting vulnerability posture and remediation progress clearly and concisely. Process Improvement & Documentation Maintain and continuously improve vulnerability management SOPs, playbooks, and process documentation. Identify opportunities to automate or streamline scanning, reporting, and remediation tracking workflows.