Cyber Security: Vulnerability Management Lead (Hybrid)

NHS Supply Chain; Nottingham; Hybrid; GBP 52,000 - 70,000; Part time

Benefits offered by this job

Hybrid working

Annual bonus scheme

Generous pension

Paid volunteering leave

Employee Assistance Programme

Job summary

NHS Supply Chain is seeking a Cyber Security Manager to lead the Vulnerability Management Service and drive risk-based remediation across the technology estate. The role operates in a SIAM model with oversight of multiple providers and a focus on regulatory compliance and resilience.

You will own strategy, policy, and standards for vulnerability management and collaborate with internal teams to protect critical services while supporting transformation and business goals.

Qualifications

• Proven leadership and influential abilities.
• Strong supplier and stakeholder management capabilities.
• Strong analytical and risk assessment skills.
• Ability to communicate cyber risks to non-technical audiences.
• Excellent reporting and presentation skills.
• Ability to challenge constructively and drive accountability.

Responsibilities

• Own and develop Vulnerability Management Strategy, Framework, Policies and Standards.
• Lead the delivery and continuous improvement of vulnerability management capabilities.
• Drive governance across vulnerability identification, assessment, prioritisation, remediation, exception management and reporting.
• Act as Service Owner for Vulnerability Management within the SIAM model.
• Coordinate activities across multiple service providers to ensure effective remediation.
• Hold suppliers accountable for delivery against targets and contractual obligations.

Skills

Leadership

Supplier management

Risk assessment

Communication

Reporting

Stakeholder management

Organisation & prioritisation

Education

CISSP

CISM

CRISC

GIAC

ITIL Foundation

SIAM Foundation

ISO 27001 Lead Auditor/Lead Implementer

CAF knowledge

Job description

NHS Supply Chain is seeking a Cyber Security Manager to lead the Vulnerability Management Service and drive risk-based remediation across the technology estate. The role operates in a SIAM model with oversight of multiple providers and a focus on regulatory compliance and resilience.

You will own strategy, policy, and standards for vulnerability management and collaborate with internal teams to protect critical services while supporting transformation and business goals.