Vulnerability Management Lead (Brussels)

Bridge351; Evere; Hybrid; EUR 70,000 - 110,000; Full time

Benefits offered by this job

Tech Visa program

Health and Life Insurance

Job summary

Bridge351 in Brussels is seeking an experienced security professional to lead vulnerability management improvements for a leading European banking group. You will redesign end-to-end processes, set up governance, and build reporting used by IT teams, risk owners and leadership.

This role involves aligning with ISO 27001 and NIS2 and driving change across the organisation. The position requires hands-on delivery, strong data storytelling, and the ability to coach teams on prioritisation and

Qualifications

• 6+ years in IT or information security, including 3+ years in vulnerability management.
• Proven experience designing or improving a security process end to end.
• Hands-on experience with an enterprise scanning platform (Tenable, Qualys, Rapid7, Tanium).
• Strong understanding of CVSS, exploitability data and risk-based prioritisation.
• Experience building security dashboards (Power BI, Tableau, Splunk or VM platform reporting).
• Familiarity with ISO 27001, NIST CSF or CIS Controls, and with NIS2.

Responsibilities

• Assess the current vulnerability lifecycle (discovery, triage, prioritisation, remediation, verification, closure) and identify gaps.
• Design and roll out a target process with clear roles (RACI), workflows and handovers between Security and IT.
• Industrialise risk-based prioritisation using contextual data.
• Implement remediation SLAs and an exception / risk-acceptance process.
• Improve scan coverage and asset inventory alignment so no critical asset is left unscanned.

Skills

Vulnerability management

Security process design

Dashboards reporting

Risk-based prioritisation

Stakeholder engagement

ISO 27001 / NIST / CIS Controls

Education

Master's degree

Tools

Tenable

Qualys

Rapid7

Tanium

Job description

Bridge351 is hiring for a leading European banking group in Brussels.

You'll help turn vulnerability management into a risk-based, measurable process. Today the organisation finds vulnerabilities. You'll make sure the right ones get fixed first, back it up with clear numbers, and show the trend to management.

This is a hands-on improvement role. You will redesign the end-to-end process, set up the governance around it, and build the reporting that IT teams, risk owners and leadership actually use.

WHAT YOU WILL DO

Process design and improvement

• Assess the current vulnerability lifecycle (discovery, triage, prioritisation, remediation, verification, closure) and identify gaps
• Design and roll out a target process with clear roles (RACI), workflows and handovers between Security and IT
• Industrialise risk-based prioritisation using contextual data
• Implement remediation SLAs and an exception / risk-acceptance process
• Improve scan coverage and asset inventory alignment so no critical asset is left unscanned

Reporting and metrics

• Define KPIs and KRIs: scan coverage, mean time to remediate, SLA compliance, critical exposure, ageing backlog
• Build dashboards for remediation teams, management and executives (CISO, risk committee, board)
• Automate data collection and reporting, replacing manual spreadsheet work
• Turn the numbers into clear trends and recommendations

Governance and stakeholders

• Write or update the vulnerability management policy, standards and procedures
• Align the process with ISO 27001, NIST CSF, CIS Controls and NIS2
• Drive the change on the ground and coach teams on prioritisation and remediation
• Integrate vulnerability data with the CMDB for automatic assignment and tracking

WHAT WE ARE LOOKING FOR

• 6+ years in IT or information security, including 3+ years in vulnerability management
• Proven experience designing or improving a security process end to end, not only running it
• Hands-on experience with an enterprise scanning platform (Tenable, Qualys, Rapid7, Tanium)
• Strong understanding of CVSS, exploitability data and risk-based prioritisation
• Experience building security dashboards (Power BI, Tableau, Splunk or VM platform reporting)
• Solid technical knowledge of operating systems, networks, cloud and application stacks
• Familiarity with ISO 27001, NIST CSF or CIS Controls, and with NIS2
• Experience in a regulated sector (financial services, energy, healthcare)
• Master's degree
• Excellent English, and the ability to understand business conversations in French

NICE TO HAVE

• Banking experience
• Scripting or automation (Python, PowerShell) and platform APIs
• ServiceNow Vulnerability Response or a similar workflow tool
• Project or change management (ITIL, Prince2, Agile)
• CISSP, CISM or CRISC certification

WHAT MAKES YOU SUCCEED HERE

• You prefer a simple process that people follow over a perfect one that nobody uses
• You are data-driven and can tell a clear story with numbers
• You get things done through teams you don't manage

LOCATION AND WORK MODEL

Brussels, Belgium – hybrid (50% on site, 50% remote).

What can you expect from us?

Mind-blowing workplace culture. You will be integrated in a professional, dynamic and collaborative team.

100% Remote opportunities

We want you to have the flexibility to work where you feel most comfortable and productive.

International Career

• You can expect professional growth and to be connect with the world.
• We are represented in Portugal, Belgium, Luxembourg, and Denmark.
• And with projects in many other countries: Netherlands, Luxembourg, Singapore and in the United States of America (and a lot more is coming…)

Extra Benefits & Perks

If you wish to work with us and you are outside European Union (good news…) we are a Tech Visa Company, We will help!

As a plus, we provide Health and Life Insurance.