Purpose of Job

The role sits within the IT Security and Business Continuity team, (part of Cyber Security Operations) which is responsible for protecting the confidentiality, integrity, and availability of the Bank’s information assets. The focus of this role is to contribute to Vulnerability Management activities and to the continued operations of Information and Computer Technology systems. The role will be contributing to Major Incident (MI) calls where required to triage any potential cybersecurity events or threats which may impact the Bank. The IT Security VM Analyst will also support the Security Operations team in responding to ServiceNOW ticket requests as part of the ongoing Bank Security Operations tasks.

The role comes with expectation to be on-site in Canary Wharf office as required (minimum 2-3 days or 50% a week).

Accountabilities & Responsibilities

• The IT Security Vulnerability Management Analyst will have the following objectives:
• Monitor and evaluate systems’ cybersecurity state, analyse, and
• Contribute to the development, maintenance, and ongoing assessment of Vulnerability Management process, to mitigate the impact of cybersecurity vulnerabilities
• Reduce risk to the Bank through effective Vulnerability Management practices
• Identify, analyse, mitigate, and effectively communicate vulnerabilities to resolver teams
• Establish procedures for vulnerability results analysis and threat intelligence evaluations
• Adopt and develop vulnerability and pen testing and remediation techniques
• Cooperate with outsourced partners and MSSPs’ SOC teams

Knowledge, Skills, Experience & Qualifications

• Expertise in Microsoft (Server & Workstation), UNIX and Linux Operating Systems
• Educated to degree level (Computer Science or similar)
• In-depth knowledge of technical security solutions covering areas such as: SIEM, EDR, DLP, WAF, email security, DNS, encryption, PKI, cloud security, threat intelligence gathering, threat hunting, knowledge of MITRE framework and an understanding of the cyber ‘Kill Chain’
• A suitable Security Certification such as CISSP, CISM or GIAC (GEVA preferred)
• Verifiable experience and examples of assessing vulnerabilities in a similar role
• Pen testing results interpretation, tracking and efficient remediation best practices
• Relevant experience in the Financial Services sector
• Set up scanning, policies, review reports, prioritise vulnerabilities – work with the teams to remediate the vulnerabilities. Demonstrable experience of conducting security assessments and threat identification, mitigation and remediation# Working knowledge of security risk oversight, CVSS (Common Vulnerability Scoring System), CVE (Common Vulnerabilities and Exposures), and technical security vulnerability remediation/mitigation
• Practice all technical, functional and operational aspects of VM and remediation response
• Collect, analyse and correlate cyber threat information from multiple sources including pen tests, scanning tools and open source intelligence to initiate remediation activities
• Work on operating systems, servers, cloud and relevant infrastructures
• Communicate, present and report to relevant stakeholders
• Experience operating vulnerability and compliance scanning tools such as Qualys, Tenable Nessus Security Centre, Tripwire or similar
• Operating systems and computer networks security
• Computer systems vulnerabilities

Please be advised internal applicants are only eligible to apply once the probation period in your current role has been passed.

Please note that CCTs and applicants working directly for a Board office can only apply for jobs advertised via the external website.