Threat and Exposure Analyst

Nominet; Oxford; Hybrid; GBP 60,000 - 90,000; Full time

Benefits offered by this job

Early Finish Friday

34-hour working week with full-timepay

30 days annual leave + bank holidays

Bupa private healthcare

Pension scheme

EV on-site charging points

Rewards platform with discounts

Medicash discounts

Annual company bonus

Job summary

Nominet in Oxford is seeking two Threat & Vulnerability Analysts for a hybrid, permanent role. You will own day-to-day vulnerability triage and exposure tracking across cloud, apps, APIs and networks, coordinating with Security Operations, Technology, GRC, suppliers and managed partners to drive remediation.

You will translate threat intelligence into practical actions for prioritisation, reporting and control improvement while challenging unclear evidence to keep remediation moving and protect

Qualifications

• Experience in vulnerability management, threat intelligence, security operations or related cyber security discipline.
• Strong understanding of vulnerability and exposure management processes from discovery to remediation.
• Ability to combine vulnerability data, threat intelligence, asset context and business criticality to identify exposures that create the greatest risk.
• Working knowledge of CVSS, EPSS, known exploited vulnerabilities, MITRE ATT&CK, attack surface management, cloud, application, endpoint, network, identity and third-party risk.

Responsibilities

• Own vulnerability triage and exposure tracking, ensuring weaknesses are assessed, prioritised and driven to closure.
• Monitor vulnerability data, threat intel, vendor advisories and known exploited vulnerabilities to identify emerging risks.
• Assess exposure across cloud, applications, APIs, endpoints, identities, networks, infrastructure, suppliers and exposed services.
• Prioritise remediation using exploitability, external exposure, asset criticality, service impact and business context.
• Collaborate with Technology, Engineering, service owners and suppliers to agree remediation actions.
• Support attack-surface discovery and identify recurring exposure patterns and unmanaged assets.
• Translate threat intelligence into practical actions for prioritisation, threat hunting, detection and control improvement.
• Produce reporting on material exposure, remediation progress and issues requiring escalation.

Skills

Vulnerability management

Threat intelligence

Security operations

Exposure management

Incident response

Stakeholder communication

Tools

Tanium

Microsoft Defender

S1

Snyk

SIEM

EDR/XDR

ServiceNow

Jira

Job description

Date: 9 Nov 2026

Location: Oxford/ Hybrid, GB, OX4 4DQ

Contract Type: Permanent

Hybrid, with a minimum of 20% in the Oxford office per month

We have two positions available

About Us

We’re Nominet – a world-leading domain name registry operating at the heart of the UK internet. While we're best known for running .UK domains, our DNS expertise also underpins critical internet infrastructure that government services, including the NHS, rely on. As a public benefit company, our work has a positive impact on society. We’ve donated millions to projects that use technology to improve people’s lives and have committed to delivering £60m worth of support over the next three years.

The Role

The Threat & Vulnerability Analyst will help Nominet reduce real-world cyber exposure across its critical services, cloud platforms, infrastructure, applications, suppliers and data systems. This is a hands-on analytical role that brings together vulnerability data, threat intelligence, attack-surface context and business criticality to identify what matters most and drive prioritised remediation action. Rather than treating vulnerabilities as isolated technical findings, you will consider exploitability, external exposure, known attacker behaviour, service impact, compensating controls, misconfigurations, identity and privilege weaknesses, and the potential impact on Nominet’s critical services. You will own day-to-day vulnerability triage and exposure tracking, working closely with Security Operations, Technology, Engineering, GRC, suppliers and managed security partners to turn complex technical data into clear action, evidence and reporting. You will need to challenge unclear or incomplete evidence, simplify complexity, and keep remediation moving, ensuring attention stays focused on exposures that create genuine risk to resilience, customer trust and business outcomes.

What You’ll Be Doing

• Own vulnerability triage and exposure tracking, ensuring material weaknesses are assessed, prioritised and driven through to closure.
• Monitor vulnerability data, threat intelligence, vendor advisories and known exploited vulnerabilities to identify emerging risks relevant to Nominet.
• Assess exposure across cloud, applications, APIs, endpoints, identities, networks, infrastructure, suppliers and externally exposed services.
• Prioritise remediation using exploitability, external exposure, asset criticality, service impact, attacker behaviour and business context.
• Work with Technology, Engineering, service owners and suppliers to agree proportionate remediation or mitigation and track actions through to completion.
• Support attack-surface discovery and identify recurring exposure patterns, unmanaged assets and systemic control weaknesses.
• Translate threat intelligence into practical actions for vulnerability prioritisation, threat hunting, detection and control improvement.
• Produce clear reporting on material exposure, remediation progress, exceptions, risk decisions and issues requiring escalation.

About You

• Experience in vulnerability management, threat intelligence, security operations, exposure management, incident response or a closely related cyber security discipline.
• Strong understanding of vulnerability and exposure management, including discovery, validation, prioritisation, remediation, exception handling, risk acceptance and escalation.
• Ability to combine vulnerability data, threat intelligence, asset context and business criticality to identify and prioritise the exposures that create the greatest risk.
• Working knowledge of areas including CVSS, EPSS, known exploited vulnerabilities, MITRE ATT&CK, attack surface management, cloud, application, endpoint, network, identity and third-party risk.
• Experience using vulnerability and security tooling such as Tanium, Microsoft Defender, S1, Snyk, SIEM, EDR/XDR, ServiceNow, Jira, or equivalent platforms.
• Strong analytical and communication skills, with the ability to challenge unclear evidence, explain risk clearly, and work with technical and non-technical stakeholders to drive actions through to closure.

Nice To Have

• Experience working in a critical service, regulated, infrastructure, cloud or technology-led environment.
• Understanding of frameworks such as NIST CSF, ISO 27001, CIS Controls, Cyber Essentials, OWASP or the NCSC Cyber Assessment Framework.
• Experience using scripting, workflow automation, data analysis, or reporting tools to improve vulnerability triage, remediation tracking, or reporting.
• Relevant cyber security qualifications, or equivalent practical experience.

Our Values

• We Make Things Happen
• We Pull Together
• We Bring A Positive Mindset
• We Keep It Simple

Our people make things happen, but our values are our compass as a company, guiding our day-to-day work and building our culture. They reflect that we're strongest when we're proactive and pull together, while underlining the importance of a "glass half full" mindset and aiming to keep things simple for success.

What We Offer

• Early Finish Friday – 34-hour working week with full-time pay (finish at midday on Friday)
• 30 days annual leave plus bank holidays, with the option to buy an additional 5 days
• Bupa private healthcare + Employee Assistance Programme
• Pension scheme matched to 7%
• Electric vehicle scheme with on-site charging points
• Rewards platform with discounts at hundreds of retailers and restaurants
• Medicash discounts on routine healthcare including optical and dental
• Annual company bonus

Diversity Statement

We're passionate about creating a workplace where every individual is valued, respected, and empowered. Somewhere we can benefit from all forms of diversity and discover the true value in our differences. If there are any adjustments we could make to the recruitment and selection process to support you, please let us know.

Security Statement

Nominet is committed to the safeguarding and welfare of the internet and expects all employees and volunteers to share this commitment by participating in the relevant security and screening processes. All roles working for Nominet will be subject to a Baseline Personnel Security Standard (BPSS) check. Some roles, due to the nature of their work, will require additional security clearance.

Please note that Nominet is unable to provide visa sponsorship or relocation support for this position.