Cyber Security Penetration Testing Lead (Program Management)

Description

The company runs and modernises mission-critical technology systems for large global businesses.

This role sits in the Integrated Exposure Operations team within the Chief Information Security Office, which manages enterprise cyber risk through vulnerability management, security validation, penetration testing oversight and remediation coordination.

The team is working to find, rank, check and cut cyber risk across a complex global technology estate.

Responsibilities

• Own the planning, execution, tracking and closure of enterprise penetration tests and other security validation work against internal security standards.
• Run vulnerability and exposure processes so that findings are ranked by risk and followed until they are fixed.
• Work with solution owners, engineers, Cyber Operations and remediation teams to speed up risk reduction.
• Lead findings reviews, remediation workshops, risk acceptance discussions and retest readiness checks.
• Report remediation progress, risk treatment plans, service metrics and KPIs to technical and executive audiences.
• Handle exception requests, compensating controls, executive approvals and risk records under governance rules.
• Collect and maintain evidence for audit, compliance and risk closure.
• Improve vulnerability, exposure and validation capabilities through process changes and new ways of working.
• Support strategic programs that improve visibility, risk ranking and overall security posture.
• Act as the central coordinator for validation and remediation, building trusted relationships across technical, operational and leadership groups.

Requirements

• Required: 7+ years in cybersecurity, vulnerability management, exposure management, security operations, cyber risk management or a related field.
• Required: solid grasp of vulnerability management, risk-based vulnerability management, exposure management and remediation governance.
• Required: experience coordinating penetration tests, security assessments or other validation activities.
• Required: ability to rank vulnerabilities and findings by risk, exploitability, business impact and threat intelligence.
• Required: experience working with application owners, infrastructure teams, Cyber Operations and remediation stakeholders to reduce risk.
• Required: knowledge of cyber risk frameworks, governance processes and security control validation methods.
• Required: experience running remediation programs, tracking corrective actions, managing retests and supporting risk closure.
• Required: strong analytical and problem-solving skills, with the ability to explain technical findings in business risk terms.
• Required: clear written and spoken communication, including presenting risks, trends and recommendations to senior stakeholders.
• Required: experience in large, complex enterprises with many stakeholders and competing priorities.
• Required: experience leading cross-functional initiatives and process improvements that raise security outcomes.
• Required: a growth mindset, a habit of continuous learning and an interest in hard cybersecurity problems.
• Preferred: bachelor's degree in cybersecurity, computer science, information technology, engineering or a related discipline.
• Preferred: experience with exposure management, attack surface management, continuous security validation or cyber risk quantification platforms.
• Preferred: experience with security validation tools, vulnerability platforms and remediation orchestration technologies.
• Preferred: familiarity with enterprise risk management, audit, regulatory and compliance requirements.
• Preferred: experience supporting executive reporting, operational metrics and cybersecurity governance forums.
• Preferred: knowledge of cloud security platforms and modern application security practices.
• Preferred: experience working with vulnerability scanners, penetration testing providers and security assessment teams.
• Preferred: industry certifications such as CISSP, CISM, CRISC, Security+, GSEC, CGRC or equivalent.
• Preferred: experience supporting cybersecurity transformation or operational maturity programs.

Conditions

Hybrid-friendly work arrangement.

The company welcomes people of all backgrounds and encourages applications even if you do not meet every requirement.

Benefits

• Be Well programs supporting financial, mental, physical and social health.
• Career planning tools, personalized development goals and regular feedback.
• Learning options including certifications with Microsoft, Google and Amazon, plus coaching and hands-on experience.
• This is not an incident response or SOC role. You will help shape how cyber risk is identified, prioritized, validated and reduced across the enterprise.