Vulnerability Lead - Engine by Starling (IT)

Description At Engine by Starling , we are on a mission to find and work with leading banks all around the world who have the ambition to build rapid growth businesses, on our technology. Engine is Starling's software-as-a-service (SaaS) business, the technology that was built to power Starling Bank, and two years ago we split out as a separate business. Starling Bank has seen exceptional growth and success, and a large part of that is down to the fact that we have built our own modern technology from the ground up. This SaaS technology platform is now available to banks and financial institutions all around the world, enabling them to benefit from the innovative digital features, and efficient back-office processes that has helped achieve Starling's success. As a company, everyone is expected to roll up their sleeves to help deliver great outcomes for our clients. We are an engineering led company and we're looking for someone who will be excited by the potential for Engine's technology to transform banking in different markets around the world. Hybrid Working We have a Hybrid approach to working here at Engine - our preference is that you're located within a commutable distance of one of our offices so that we're able to interact and collaborate in person. About the Role We're seeking a passionate and experienced Vulnerability Lead to shape and lead the creation and ongoing operation of our comprehensive vulnerability management program. This is a unique opportunity to establish a critical security function, define best practices, and significantly enhance our overall security posture. A key aspect of this role involves the end-to-end management and continuous improvement of the vulnerability management programme. This includes defining scanning strategies, conducting risk-based triage and prioritisation, overseeing remediation efforts, and providing actionable reporting to enhance the Engine's security posture. What you'll get to do: Conduct vulnerability scans regularly and proactively as needed. Validate findings and use a risk-based approach. Enrich findings with threat intelligence and business impact to determine exploitability. Be an enabler for resolver groups by triaging and prioritising vulnerabilities to facilitate timely resolution of outstanding findings using a risk based approach Track and manage remediation through to closure with Technology and Security teams. Ensure timely patching of critical vulnerabilities in line with SLAs. Ensure visibility across the technology estate, including cloud environments. Coordinate scanning and coverage of data centre estate, cloud infrastructure, containers, mobile SDKs, and web apps. Process vulnerability data to provide reports, insights and metrics, that aid in the risk-based approach to vulnerability management. Identify and flag blind spots or gaps in scan coverage or asset inventory. Keep up with zero-day disclosures and emerging threats. Maintain and share dashboards and reports on vulnerability trends, KPIs, and SLA compliance. Review and update Vulnerability Management related documentation to align with internal and external compliance Candidate profile: requirements, industry best practices and emerging threats (e.g. ISO 27001, PCI DSS/3DS, SOC 2 and NIST) Help define scanning schedules, thresholds, and automation opportunities. Collaborate with DevSecOps/Product Teams to embed security scanning into CI/CD pipelines. Assist in evaluating new tooling and processes for better automation and risk tracking. Requirements Essential Strong engineering and automation background with an interest in vulnerability management Strong automation skills with CI/CD experience Strong technical knowledge, including: Cloud Experience (AWS, GCP) Kubernetes and Container experience Infrastructure as code (Terraform) Dashboard creation, front-end experience Self-sufficient - can be a trusted escalation point across teams Can drive improvements to visibility and remediation workflows 5+ years experience in vulnerability management, security operations, infrastructure security or security engineering Familiarity with end-to-end vulnerability management lifecycle including associated tools and platforms Ability to work effectively with patching teams and co-ordinate remediation activities Understanding of CVSS scoring, OWASP Top 10 and MITRE ATT&CK Organised and able to track and report on remediation activities across multiple teams Can translate scan data into clear, risk-based reports for management teams Partner with the information security risk management team on assurance activities Desired Practical experience in one or more of the Vulnerability Management fields: Vulnerability Intelligence, AppSec Vulnerability Management, Vulnerability Management of cloud native workloads Open source scanning tool such as Trivy or similar Interview process Interviewing is a two way process and we want you to have the time and opportunity to get to know us, as much as we are getting to know you! Our interviews are conversational and we want to get the best from you, so come with questions and be curious. In general you can expect the below, following a chat with one of our Talent Team: Stage 1 - 45 mins with BISO Stage 2 - 60 min with Peers Stage 3 - Final with CTO/Deputy CTO Benefits 33 days holiday (including public holidays, which you can take when it works best for you) An extra day's holiday for your birthday Annual leave is increased with length of service, and you can choose to buy or sell up to five extra days off 16 hours paid volunteering time a year Salary sacrifice, company enhanced pension scheme Life insurance at 4x your salary & group income protection Private Medical Insurance with VitalityHealth including mental health support and cancer care. Partner benefits include discounts with Waitrose, Mr&Mrs Smith and Peloton Generous family-friendly policies Incentives refer a friend scheme Perkbox membership giving access to retail discounts, a wellness platform for physical and mental health, and weekly free and boosted perks Access to initiatives like Cycle to Work, Salary Sacrificed Gym partnerships and Electric Vehicle (EV) leasing