Vulnerability Management Analyst

Inspired Thinking Group (ITG); Birmingham; On-site; GBP 55,000 - 75,000; Full time

Benefits offered by this job

Time off and wellbeing days

Enhanced family-friendly leave

Pension scheme

Private medical cash plan

Employee recognition rewards

Job summary

Inspired Thinking Group (ITG) is seeking a Vulnerability Management Analyst to join our information security and data protection team. You will find, prioritise, and remediate vulnerabilities across our global product estate, configuring tooling, assessing risk, and guiding remediation with Developers and Engineers.

You will coordinate external IVS and Penetration Testing, align with industry frameworks, and contribute to policy and process improvements while benefiting from a funded training

Qualifications

• 2+ years' experience in vulnerability management, security operations, development, or a related security/IT role

Responsibilities

• Configure and tune vulnerability tooling across scanning tools and pipelines
• Triage findings, risk-assess severity, and prioritise fixes
• Design secure benchmarks and hardening guidelines for software and infrastructure
• Collaborate with Developers and Engineers to fix issues and guide remediation
• Coordinate external IVS and Penetration Testing programmes
• Produce reporting on SLA performance, open findings, and trends
• Contribute to vulnerability management policies, standards, and procedures

Skills

Vulnerability management

Security operations

SAST

DAST

SCA

CSPM

IVS

OWASP Top 10

MITRE ATT&CK

Code familiarity

Tools

Vulnerability tooling

CI/CD pipelines

Penetration testing

Job description

We are looking for an enthusiastic and detail-oriented Vulnerability Management Analyst to join our information security and data protection team. This is an ideal opportunity for someone with real-world experience in information security and data protection. It's a great opportunity to get hands-on with the tools and processes that keep all our products secure, and to make a genuinely visible difference to how we manage risk day to day.

The Role:

The Vulnerability Management Analyst will help us find, prioritise, and fix security vulnerabilities across our global business and all our products. You'll configure and tune our vulnerability tools, risk assessing detections, and prioritising findings for fix. You'll cover code vulnerabilities (SAST, DAST, SCA, OSS licencing), Cloud Security Posture Management (CSPM), Internal Vulnerability Scanning (IVS), and penetration testing. You'll also help design and report on our detection and remediation activities. This is a full-time position. Occasional after-hours work may be required for incident response or urgent security tasks. Successful candidates will be enrolled on a fully funded training pathway and will be provided with mentoring support to help them grow and learn.

Responsibilities:

1. Configuring and tuning our tools

• Help configure, tune, and maintain our vulnerability tooling across scanning tools, working with platform and engineering teams to keep coverage accurate
• Support day-to-day scanning schedules and tooling integrations, including ticketing and CI/CD pipelines
• Look for opportunities to automate reporting, validation, and other repetitive tasks across the whole vulnerability lifecycle

2. Triage and risk assessment

• Triage findings from vulnerability sources, confirming genuine issues and filtering out false positives
• Risk-assess confirmed findings against severity, exploitability, and business context, to prioritise fixes
• Apply a consistent risk-scoring approach so findings are prioritised effectively, regardless of source
• Stay on top of current threats and trends (e.g. threat actors, new vulnerabilities etc.) to inform vulnerability management activities

3. Designing secure benchmarks and guidelines

• Develop and maintain secure configuration benchmarks and hardening guidelines for our software, infrastructure, and tooling
• Align benchmarks and guidelines to recognised industry frameworks for business
• Work with the right teams to help implement the secure configurations, providing practical advice, and facilitating deviations within our broader risk management framework

4. Working with Developers and Engineers

• Act as a primary contact point for Developers and Engineers to help them understand and fix issues
• Track remediation progress, chase owners on overdue items, elevate where necessary
• Support teams with practical remediation guidance, drawing on the OWASP Top 10, the Mitre Att&ck Framework, and our secure coding standards

5. Coordinating IVS, web application testing, and penetration testing

• Organise our externally delivered IVS and Penetration Testing programmes, from scheduling and scoping, through to day-to-day contact with our testing partners
• Help manage our relationships with testing providers, including engagement administration and reporting

6. SLAs, outcome driven metrics, and reporting

• Help design and report on remediation SLAs across vulnerability classes, severities, and products
• Produce regular reporting (monthly, quarterly, and ad-hoc) on SLA performance, open findings, and trends
• Feed data and insight into our wider security metrics and reporting processes

7. Continuous improvement and team support

• Suggest ways to improve how we manage vulnerabilities and the tools we use to do it
• Support the rollout of new scanning tools or process changes across our global product estate
• Help create and maintain our vulnerability management policies, standards, and procedures

Requirements:

• 2+ years' experience in vulnerability management, security operations, development, or a related security/IT role
• Hands-on experience with vulnerability scanning and management tooling (e.g. SAST, DAST, SCA, CSPM, or IVS)
• Solid understanding of common vulnerability types and remediation approaches, including familiarity with the Mitre ATT&CK Framework and OWASP Top 10
• Experience triaging and risk-assessing security findings, helping teams to prioritise remediation based on severity and business impact
• Comfortable coordinating third-party engagements, such as scheduling and scoping penetration tests
• Comfortable explaining technical findings to both Developers and non-technical stakeholders
• Organised enough to manage several scanning programmes, testing engagements, and remediation workstreams in parallel
• Comfortable working across a global, multi-product environment
• Comfortable working within an agile enterprise environment
• Ability to read and understand common coding languages is essential, the ability to write scripts and/or code is preferred
• Relevant certifications (e.g. CompTIA Security+, CompTIA CySA+, GIAC GFACT/GPEN, or CEH) are preferred but not essential
• Strong analytical and problem-solving mindset, with real attention to detail
• Ability to work autonomously, use good judgement, and know when to escalate

Benefits at ITG

• Time off that works for you — 25 days' holiday + bank holidays, a paid Wellbeing Day, flexible bank holidays to honour cultural or religious observances, and the option to buy or carry over up to 5 extra days
• Family & life milestones — Enhanced family friendly leave, 3 extra days for your wedding/honeymoon, and an Employee Assistance Programme whenever you need support
• Financial perks — Pension scheme, Corporate Medical Cash Plan, electric car salary sacrifice scheme, and tax-efficient payroll giving to your favourite charities
• Growth & recognition — Funding for professional qualifications, monthly Employee of the Month awards (£250 bonus), and referral bonuses of up to £1,500
• Community & wellbeing — Regular Wellbeing Workshops, 30+ Wellbeing Champions, a paid Volunteer Day, and an online perks platform with discounts on top brands, days out, and gym memberships

We Value Diversity

We champion and welcome diversity in our workforce and ensure all job applicants receive equal and fair treatment, regardless of age, race, gender or gender identity, religion, sexual orientation, disability, or nationality.

We are not only committed to increasing the visibility and recognition of talent from under-represented groups within our organisation, but the wider industry too.

At the end of the day, we make sure we take time to look after ourselves, each other, and the planet, because we're always stronger together.

ITG have a number of community groups available to employees and exist to offer a safe space for like-minded colleagues, with shared interests to connect, socialise and check in with each other.