Assistant Vice President - Vulnerability Management

SBI Card; Gurugram District; On-site; INR 900,000 - 1,500,000; Full time

Job summary

SBI Card is seeking a senior role to lead vulnerability assessment, penetration testing, and patch management across its IT landscape. The candidate will develop and operationalize vulnerability management frameworks, drive remediation, and provide expert input on information security policies and standards.

Strong coordination with vendors and leadership is essential. The role requires deep knowledge of vulnerability remediation, risk analysis, compliance standards, and hands-on experience with

Qualifications

• Understanding vulnerability management including assessment and remediation.
• Experience analyzing risk, prioritizing vulnerabilities, validating reports, driving remediation.
• Understanding threat and vulnerability management process with metrics.
• Knowledge of ISO 27001, NIST CSF, PCI-DSS and related standards.
• Enterprise security controls, network protocols, Windows/Linux environments.
• Strong knowledge of VAPT tools: Nessus, Rapid7, AWS Inspector, open-source tools.

Responsibilities

• Lead vulnerability assessment, penetration testing, and patch management programs aligned to strategy.
• Develop and implement vulnerability management frameworks and security testing initiatives.
• Plan capabilities, methods, and improvements for vulnerability management and testing.
• Provide security policy and standards expertise across the organization.
• Conduct assessments, communicate security issues to technical and non-technical audiences.
• Prioritize vulnerabilities and drive remediation efforts with IT asset owners.
• Coordinate patch management for all IT assets and monitor deployment schedules.
• Engage with vendors, monitor SLAs, and maintain SOPs aligned with SBI Card policies.
• Provide program management oversight over vendor teams and reporting to leadership.

Skills

Vulnerability management

Risk analysis

Threat management

Compliance standards

Security controls

VAPT tools

Education

Bachelor of Engineering / CS

Master in CS

Tools

Nessus

Rapid7

AWS Inspector

Job description

Role Purpose

Responsible for implementing and managing Infrastructure vulnerability tools and processes to reduce technical risks due to vulnerabilities, including identifying and evaluating vulnerabilities and supporting remediation activities. This role is also responsible for leveraging expert knowledge of today's ever-changing cybersecurity and risk landscape to influence IT landscape across SBIC Card environment.

Role Accountability

• Lead the Vulnerability Assessment, Penetration Testing & Patch Management Program in support of the functional & company strategy, goals, and performance objectives
• Manage development, implementation, and effectiveness of vulnerability management and security testing programs, initiatives, and capabilities
• Assist with planning, providing input on capabilities and methods used for vulnerability management and security testing, and driving improvements
• Develop Vulnerability management framework, support compliance and risk management activities, recommending security controls and corrective actions to mitigate vulnerability risks
• Provide technical expertise for information security policies and standards
• Conduct vulnerability assessments and penetration testing (application and/or infrastructure) and articulating security issues to technical and non-technical audience
• Perform vulnerability risk profiling and prioritization of vulnerabilities
• Identify, research, validate, and exploit various different known and unknown security vulnerabilities on server and client side
• Perform regular status reviews with IT asset owners & senior leadership to ensure compliance with InfoSec policies
• Coordinate patch management/Remediation activities for all IT assets (workstations, network, server, application, database etc.)
• Develop and Monitor patch deployment schedules for all Vulnerability assessments and penetration testing on an ongoing basis as well as auditing for completeness
• Provide communications across the organization, interfacing senior leadership on vulnerability remediation, driving security hardening best practices, and representing the Vulnerability and Patch Management team
• Maintain relationship with managed security services vendor leadership to ensure effective implementation and operation of security programs, ongoing support and deployment of competent resources
• Oversee the development, implementation and maintenance of vendor standard operating procedures/ run book in line with SBI Card policies & standards
• Provide technical & program management expertise and oversight over vendor teams
• Monitor vendor SLAs, perform regular review with vendor management and report to SBI Card leadership
• Ensure process documentation and compliance adherence

Measures of Success:

• Reduction in security vulnerabilities in SBI Card IT platforms
• Number of enhancement opportunities identified for the security posture to reduce overall risk to SBI Card
• Reduction in information leakage and exploitation from vulnerabilities
• Security metrics / SLA / KPIs are within acceptable threshold
• Timely updation of Application Security & Vulnerability Management related standards and SOPs and other documents
• No adverse observations in Internal / External Audits
• Process Adherence as per MOU.

Technical Skills / Experience / Certifications:

• Understanding of Vulnerability Management Program including Assessment and Remediation
• Experience analyzing risk and prioritization of vulnerabilities, validating vulnerability reports and driving remediation.
• Understanding of the overall threat and vulnerability management process, including metrics to measure performance
• Working knowledge of compliance frameworks and security management standards (e.g., ISO 27001, NIST CSF. PCI-DSS etc.)
• Thorough understanding of enterprise security controls, network protocols and operating system (Windows/Linux environments).
• Strong knowledge in industry standard VAPT tools like Nessus, Rapid7, AWS Inspector and open-source tools.

Competencies critical to the role:

• Stakeholder Management
• Analytical ability
• Innovation & Problem Solving

Qualification

Bachelor of Engineering in Computer Science / Engineering, master’s in computer science.

Preferred Industry

BFSI / NBFC /E-commerce/IT & ITES / Telecom