Vulnerability Management Engineer

Met Office; Devon and Torbay; Hybrid; GBP 44,503 - 54,392; Full time

Benefits offered by this job

Civil Service pension

Market supplement £2,200 per year

Annual leave 27.5–32.5 days + BH

Job summary

The Met Office is seeking a Vulnerability Management Engineer to protect organisational systems, data and services by identifying, evaluating, and driving remediation of vulnerabilities. You will work within Cyber Security Operations, coordinating with IT Operations, SOC and development teams and configuring enterprise vulnerability scanners across networks, servers, endpoints, apps, and cloud.

The role emphasizes risk-based prioritisation, cross-team collaboration, and clear guidance on

Qualifications

• Demonstrable commitment to continuous learning and professional development in cybersecurity.
• Experience with vulnerability management across infrastructure, cloud, and security platforms.
• Ability to communicate risk to technical and non-technical stakeholders.
• Understand vulnerability remediation lifecycle and prioritisation.

Responsibilities

• Plan, configure, and execute vulnerability scans across enterprise environments including cloud and on-premise systems.
• Analyse vulnerabilities to determine severity, exploitability, and business impact using risk-based methodologies.
• Coordinate remediation activity across IT and development teams to ensure vulnerabilities are resolved within agreed SLAs.
• Produce clear reports, dashboards, and metrics for technical and senior stakeholders.
• Act as a subject matter expert for vulnerability management and risk treatment.
• Support response to critical vulnerabilities and zero-day threats in collaboration with security operations.
• Drive continuous improvement of vulnerability management processes, tooling, and documentation.

Skills

Vulnerability management

Vulnerability scanning tools

Risk-based prioritisation

Vulnerability lifecycle management

Windows

Linux

Networking

Cloud technologies

Tools

Vulnerability scanning tools

Job description

We're looking for an exceptional Vulnerability Management Engineer to help us make a difference to our planet.

As our Vulnerability Management Engineer, the job may be suitable for hybrid working, which is where an employee works part of the week in the office and part of the week from home. This is a voluntary, non-contractual arrangement and the location advertised will be your contractual place of work.

Our opportunity is full time, 37 hours per week. Our people are at the heart of what we do and we'll do our best to agree a working pattern that works for everyone.

World changing work

From science to technology, from meteorology to management, and from planning to communication, our expertise helps us stand out as the authority on weather accuracy and climate prediction. We help individuals, industries and government to make better decisions to stay safe and thrive. This is the Met Office. This is who we are.

• We're a force for good - focusing on our environmental and social impact
• We're experts by nature - always learning and developing to do things better
• We live and breathe it - putting our purpose at the heart of decision-making
• We're better together - understanding partnerships and inclusivity make us greater
• We keep evolving - pushing boundaries to make tomorrow better for our customers

Your world of expertise

As a Vulnerability Management Engineer, you will play a key role in protecting the organisation's systems, data, and services by identifying, analysing, and driving the remediation of vulnerabilities across our IT estate. You will operate within the Cyber Security Operations function, working closely with IT Operations, SOC, and development teams to ensure vulnerabilities are effectively prioritised and resolved in line with risk and service level agreements. You will configure and operate enterprise vulnerability scanning tools across networks, servers, endpoints, applications, and cloud environments.

You will assess vulnerabilities using risk-based approaches, combining CVSS scoring with asset criticality and threat intelligence to determine real-world impact. You will act as a trusted advisor to technical teams and stakeholders, providing clear guidance on remediation actions and communicating complex risk in an understandable way to support decision-making.

• Plan, configure, and execute vulnerability scans across enterprise environments including cloud and on-premise systems.
• Analyse vulnerabilities to determine severity, exploitability, and business impact using risk-based methodologies.
• Coordinate remediation activity across IT and development teams to ensure vulnerabilities are resolved within agreed SLAs.
• Produce clear reports, dashboards, and metrics for technical and senior stakeholders
• Act as a subject matter expert for vulnerability management, advising on remediation and risk treatment.
• Support the response to critical vulnerabilities and zero-day threats in collaboration with security operations.
• Drive continuous improvement of vulnerability management processes, tooling, and documentation.

Our work is life-changing, often life-saving and always life-enhancing. The Met Office is Great Place to Work UK certified. We are also featured on their 'Best Workplaces in Tech' 2023, 2024 and 2025 lists, as well as their '54 Best Workplaces for Women' 2023 list.

As our Vulnerability Management Engineer, your total reward package will be up to £49,448 annually, which includes:

• An outstanding Civil Service pension, with an average employer contribution of 28.97%
• Recruitment Retention Allowance (RRA) you will be paid £2,200 per annum as a market supplement to reflect the demand for your skills. Whilst in post, you will be paid this market driven allowance from April 2026 until March 2027 in your monthly pay
• Annual Leave starting at 27.5 days (plus Bank Holidays) rising to 32.5 days (plus Bank Holidays) after 5 years and option to buy or sell up to 5 days per year of annual leave

Essential Criteria, skills and experience:

1. Keep Evolving

Demonstrable commitment to continuous learning and professional development, with the ability to stay current with emerging cybersecurity threats, vulnerability management practices, and evolving technologies across infrastructure, cloud, and security platforms.

2. Better Together

Proven ability to collaborate effectively across multiple technical teams, coordinating vulnerability remediation activities, building strong working relationships, and contributing positively to a high-performing team environment.

3. Expert by Nature

Strong technical expertise in vulnerability management, including hands‑on experience with vulnerability scanning tools, risk-based prioritisation, vulnerability lifecycle management, and a broad understanding of Windows, Linux, networking, and cloud technologies.

4. Force for Good

Able to analyse vulnerability and security data to identify real-world risk and drive actions that strengthen organisational resilience, protect critical services, and support the wider security and operational objectives of the organisation.

5. Live and Breathe It

Strong communicator and self‑motivated professional, capable of managing multiple priorities, working independently, and making informed decisions that balance business needs with effective risk management, while consistently demonstrating organisational values and purpose.

Closing date 10/08/2026 at 23:59 with first stage interviews commencing from 17/08/2026. You will hear from us once the closing date has passed.

Using AI in your application

We welcome applications that use AI tools for support in drafting or refining, as long as they accurately reflect your own skills and experience. All hiring decisions at the Met Office are made by people, not AI. For more details, visit our approach to recruitment.

How we can help

If you have any questions or would like to discuss this opportunity further, please contact us at .

If you're considering applying and need support to do so, please get in touch. You can request adjustments either within your application or by contacting us. Should you be offered an interview, please be aware there may be a selection exercise which could include a presentation, written test or a scenario-based activity. You can select in your application to be considered under the Disability Confident Scheme. To be invited to interview/assessment under this scheme, your application must meet the essential criteria for the role.

We understand that great minds don't always think alike and as an equal opportunities employer we welcome applications from those with all protected characteristics. We recruit on merit, fairness, and open competition in line with the Civil Service Code.

We can only accept applications from those eligible to live and work in the UK - please refer to GOV.UK for information. We require Security clearance, for which you need to have resided in the UK for at least 3 of the last 5 years to be eligible, 2 of these years must be immediately preceding the point of your application. You will need to achieve full security clearance within your first 6 months with us.

If you feel that your application has not been treated in accordance with the Recruitment Principles, and wish to make a complaint, then in the first instance you should contact us at: If you are not satisfied with the response that you receive, then you can contact the Civil Service Commission at: