Lead Consultant - Vulnerability Management

AstraZeneca; Chennai District; On-site; INR 4,500,000 - 7,000,000; Full time

Benefits offered by this job

Office-based in Chennai (onsite) three

Flexible work options

Job summary

AstraZeneca in Chennai is seeking a Lead Consultant to drive a risk-based vulnerability management program across OT, cloud, and on-premises systems. You will turn threat data into decisive actions, shaping discovery, prioritisation, and remediation at global scale.

As a senior individual contributor, you will coordinate across OT engineering, security, and IT teams, build governance, and develop playbooks and dashboards to measure risk reduction and progress.

Qualifications

• Lead vulnerability lifecycle across OT, cloud, and on‑premises systems.
• Prioritise threats using severity, exposure, asset criticality and impact.
• Coordinate remediation with asset owners, OT, cloud, infra, and security teams.
• Develop SOPs, playbooks, and governance documentation.
• Build executive dashboards and risk-reduction metrics.

Responsibilities

• Own governance, exception, and risk‑acceptance workflows.
• Identify, triage and prioritise vulnerabilities with a risk-based approach.
• Drive automation to scale vulnerability management.
• Lead cross-functional workstreams and enablement.

Skills

Vulnerability mgmt

OT/Cloud/Enterprise

Threat intel

Dashboard reporting

Stakeholder mgmt

Automation

Education

Technical degree

Tools

Qualys

Claroty

Wiz

MS Defender

Job description

Job Title: Lead Consultant - Vulnerability Management

GCL:E

Introduction to role:

Are you ready to lead a risk-based vulnerability management program that protects the science behind life-changing medicines? As our senior individual contributor in Chennai, you will turn rich threat and asset data into decisive action. You will work across operational technology, virtual environments, and organizational platforms. This role safeguards the systems our scientists, engineers, and clinicians rely on every day. Here, you will shape how we discover, prioritize, and remediate vulnerabilities at global scale, translating complex realities into clear standards and measurable risk reduction. Do you thrive at the intersection of OT constraints and cloud speed, bringing order to ambiguity and accelerating outcomes that matter to patients and the business?

Accountabilities:

• End-to-End Lifecycle Leadership: Maintain and continuously improve the vulnerability management lifecycle spanning operational technology, cloud environments, and on-premises infrastructure to increase coverage, quality, and time-to-remediation.
• Risk-Based Prioritisation: Identify, validate, triage, and prioritise vulnerabilities using severity, exploitability, threat intelligence, asset criticality, internet exposure, potential intrusion routes, and business impact to focus effort where it matters most.
• Remediation Orchestration: Coordinate mitigation with asset owners, OT engineering, cloud, infrastructure, Security Operations, Cyber Threat Intelligence, and service providers, removing blockers and accelerating durable fixes.
• Documentation Ownership: Convert operating practices into clear, controlled policies, guidelines, procedural manuals, detailed instructions, workflow diagrams, RACI charts, templates, and playbooks; drive adoption, training, review cycles, and continuous improvement.
• Governance and Exception Management: Run exception and risk-acceptance workflows with complete ownership, rationale, compensating controls, approvals, evidence, target dates, and scheduled reviews.
• Metrics and Insight: Build executive-ready dashboards, remediation ageing views, coverage measures, control indicators, and trends that reveal risk reduction and guide operational and governance decisions.
• Coverage and Data Quality: Improve asset onboarding, tagging, ownership, and tool configuration across approved platforms; close visibility and control gaps and validate effectiveness.
• Process Improvement and Automation: Streamline data ingestion, normalisation, correlation, prioritisation, workflow orchestration, evidence capture, reporting, and closure validation; champion automation to scale.
• Threat Monitoring and Rapid Response: Assess emerging vulnerabilities from trusted sources, determine relevance to our estate, and lead accelerated assessment and response where credible exploitation or high business exposure exists.
• Collaborator Influence and Enablement: Lead workstreams, workshops, and continuous-improvement initiatives using facilitation and subject-matter expertise. Ensure consistent standards across OT, cloud environments, and infrastructure while respecting detailed operational, safety, regulatory, or technical constraints.
• AI and Digital Tooling Adoption: Embrace and appropriately use artificial intelligence and technology-based tools to improve analysis, triage, reporting, and ways of working.

Essential Skills/Experience:

• Significant hands-on experience managing vulnerabilities or coordinating threat exposure within a complex, multinational enterprise.
• Strong practical knowledge in handling vulnerabilities across OT, cloud, and enterprise infrastructure, including differences in asset discovery, scanning, risk assessment, patching, and remediation approaches.
• Demonstrated understanding of OT and industrial environments, including legacy platforms, operational availability, safety, network segmentation, maintenance windows, vendor dependencies, firmware, and compensating controls.
• Experience assessing vulnerabilities and exposure in cloud environments, including public exposure, misconfiguration, identity and privilege context, attack paths, and cloud-native remediation workflows.
• Experience with vulnerability assessment and exposure-management platforms such as Qualys, Claroty, Wiz,MS Defender or comparable technologies, together with supporting CMDB, ticketing, reporting, and workflow tools.
• Demonstrable ability to author, restructure, and maintain high-quality standards, SOPs, work instructions, process flows, RACI models, control descriptions, and evidence requirements for technical and regulated processes.
• Solid comprehension of document governance, including ownership, approval routes, version control, controlled publication, periodic review, change records, retention, and preparedness for audits.
• Good understanding of risk-based vulnerability prioritisation, remediation governance, exception management, security controls, and recognised industry practices for IT, cloud, and OT environments.
• Ability to analyse complex technical and operational situations, balance risk reduction with service continuity and business constraints, and make clear, evidence-based recommendations.
• Experience developing meaningful metrics, trend analysis, control reporting, and executive-ready insights for programme performance, coverage, risk reduction, and remediation progress.
• Strong written, verbal, facilitation, and stakeholder-management skills, with the ability to explain technical risk and procedural requirements to technical and non-technical audiences.
• A collaborative working style, sound judgement, personal accountability, attention to detail, and the ability to deliver independently within a team environment.
• Relevant technical degree or equivalent professional experience; recognised cybersecurity, cloud, OT, risk, or service-management certifications are advantageous.

Desirable Skills/Experience:

• Experience integrating vulnerability data with SIEM/SOAR and ticketing platforms to automate triage and remediation workflows.
• Proficiency with scripting or data tooling (for example, Python, PowerShell, APIs, SQL) to normalise, correlate, and report at scale.
• Knowledge of security and risk frameworks and benchmarks (for example, NIST CSF, NIST 800-53/82, ISO 27001, CIS Controls, IEC 62443).
• Background in highly regulated or safety-critical industries, such as pharmaceuticals, medical devices, or manufacturing, including validation and audit readiness.
• Hands-on exposure to OT security tooling and constraints, including passive discovery, safe scanning practices, and firmware risk management.
• Experience building executive dashboards and storytelling with data using tools such as Power BI or Tableau.
• Familiarity with cloud-native controls and pipelines (for example, IaC scanning, CI/CD integration, identity governance) to accelerate secure remediation.
• Ability to mentor and upskill peers and partner teams in vulnerability management practices.

#Cyber

When we put unexpected teams in the same room, we unleash bold thinking with the power to inspire life-changing medicines. In-person working gives us the platform we need to connect, work at pace and challenge perceptions. That's why we work, on average, a minimum of three days per week from the office. But that doesn't mean we're not flexible. We balance the expectation of being in the office while respecting individual flexibility. Join us in our unique and ambitious world.

Why AstraZeneca:

Your work protects the digital backbone of breakthrough science, connecting engineers, data innovators, and clinicians who are pushing the boundaries of medicine. You will collaborate in environments where experimentation is encouraged, where unexpected teams spark new ideas, and where investment in modern platforms lets you solve problems at enterprise scale. We value kindness alongside ambition, pairing brand new technology with a clear mission to reach patients faster - so your contribution translates into real-world impact.

Date Posted

08-Oct-2026

Closing Date

15-Oct-2026

AstraZeneca embraces diversity and equality of opportunity. We are committed to building an inclusive and diverse team representing all backgrounds, with as wide a range of perspectives as possible, and harnessing industry-leading skills. We believe that the more inclusive we are, the better our work is. We welcome and consider applications to join our team from all qualified candidates, regardless of their characteristics. We comply with all applicable laws and regulations on non-discrimination in employment (and recruitment), as well as work authorization and employment eligibility verification requirements.