{"id":242754,"url":"https://alion.io/job/guildhall-vulnerability-manager","title":"Vulnerability Manager","company":{"id":109894,"name":"Guildhall","domain":"guildhall.agency","url":"https://alion.io/company/guildhall","size_band":"11-50","is_staffing_agency":true,"employer_type":"agency","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":{"grade":"B","score":75,"open_postings":27,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-11-02T06:13:15Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Dubai, United Arab Emirates"],"countries":["AE"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":63000,"max_usd":145000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2372},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"Docker","optional":false},{"name":"ISO 27001","optional":false},{"name":"ITSM","optional":false},{"name":"Jira","optional":false},{"name":"Kubernetes","optional":false},{"name":"Linux","optional":false},{"name":"PCI DSS","optional":false},{"name":"Qualys Cloud Platform","optional":false},{"name":"ServiceNow","optional":false},{"name":"SIEM","optional":false},{"name":"SOC 2","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-02-04T07:20:48Z","employer_posted_date":"2026-08-12","last_verified_at":"2026-09-05T10:34:13Z","board_verified":false,"closed_at":null,"days_open":271,"trust":{"level":"stale","repost_count":0,"flags":["stale"],"days_open":270},"description":"Guildhall is supporting a fast-growing technology company specializing in cybersecurity solutions, that are hiring for a Vulnerability Manager to lead its vulnerability management team. This is a senior advisory role sitting at the intersection of deep technical expertise and client-facing consultancy. The Vulnerability Management Consultant is responsible for identifying the right client opportunities, translating complex organisational security requirements into structured programmes, and leading the deployment of FendOps’ vulnerability management solution within client environments.\nKey Responsibilities:\nClient identification and advisory\nIdentify prospective clients across target sectors where vulnerability management maturity gaps create a clear commercial case for the FendOps solution.\nConduct discovery engagements with client security and IT leadership to assess their current vulnerability posture, tooling, process gaps, and organisational constraints.\nProduce advisory outputs - gap analyses, maturity assessments, deployment readiness reports - that build trust and lay the groundwork for commercial engagement.\nArticulate the business case for structured vulnerability management to non-technical stakeholders, including CISOs, CIOs, risk committees, and procurement leads.\nProgramme design and deployment\nTranslate client requirements into a structured deployment plan for the FendOps platform, covering scope, asset coverage, integration points, prioritisation logic, and reporting cadence.\nDefine the technical prerequisites each client needs in place to onboard effectively: network access and segmentation, asset inventory quality, CMDB readiness, SIEM connectivity, and CI/CD pipeline hooks where applicable.\nLead deployment engagements end-to-end - configuring the platform to reflect the client’s asset landscape, risk appetite, SLA requirements, and compliance obligations.\nAdvise clients on how vulnerability management should connect to adjacent functions: incident response workflows, change management, patch governance, threat intelligence feeds, and risk registers.\nProcess and policy embedding\nWork with client security and IT teams to define or refine vulnerability management policies, remediation SLAs, escalation paths, and exception handling procedures aligned to their regulatory context (ISO 27001, PCI-DSS, NCA ECC, and similar).\nDesign reporting frameworks and KPI sets that give client leadership genuine visibility into risk posture - not just scan outputs - including trending, SLA compliance, and exposure to active threat campaigns.\nEnsure the deployed programme is operationally sustainable, with clear ownership, escalation accountability, and a model for continuous improvement built in from the start. Cross-functional integration\nMap how the client’s vulnerability management programme intersects with DevSecOps practices, cloud and container environments, and application security pipelines, and configure the platform accordingly.\nAdvise on integration with ITSM platforms (ServiceNow, Jira, and equivalents) so that remediation workflows are embedded into the client’s existing operational processes rather than running in parallel.\nSupport clients in aligning vulnerability data with their incident response and SOC functions, so that unpatched vulnerabilities surface as context during active investigations. Ongoing advisory and programme optimisation\nServe as the trusted advisory point of contact post-deployment, reviewing programme performance, tuning prioritisation logic, and identifying coverage gaps as the client environment evolves.\nBring in credible threat intelligence to advise clients on re-prioritisation when active exploitation changes the risk calculus on specific CVEs or asset classes.\nContribute internally to FendOps product development by translating client operational feedback into structured requirements that improve the platform over time.\nCandidate Profile:\nExperience\n8+ years in information security, with a substantial portion spent leading or owning vulnerability management programmes in complex, multi-environment organisations.\nDemonstrable experience running the full programme lifecycle: scanning strategy, risk-based prioritisation, remediation coordination, SLA governance, and executive reporting.\nBackground in client-facing roles - consultancy, advisory, or professional services - is strongly preferred. The ability to build trust with technical and non-technical stakeholders is essential.\nExposure to regulated environments and the compliance frameworks that shape vulnerability management obligations (ISO 27001, PCI-DSS, SOC 2, NCA ECC, or similar).\nTechnical depth\nHands-on familiarity with the major vulnerability scanning and management platforms (Qualys, Tenable, Rapid7) and a clear understanding of their outputs, limitations, and configuration trade-offs.\nSolid working knowledge of network architecture, operating systems (Windows and Linux), cloud environments (Azure and AWS), and container security (Docker/Kubernetes) sufficient to scope and configure deployments accurately.\nUnderstanding of DevSecOps principles and how vulnerability management integrates into CI/CD pipelines and infrastructure-as-code workflows.\nFamiliarity with SIEM, SOAR, ITSM, and CMDB platforms and how they interconnect with a mature vulnerability programme\nAdvisory and communication skills\nAble to read an organisation quickly: understand its risk appetite, its internal politics, its operational constraints, and how to position vulnerability management within that context.\nSkilled at translating technical risk into business language - writing and presenting to executive audiences in a way that drives decisions, not just awareness.\nStructured and consultative in approach: comfortable producing gap analyses, deployment frameworks, maturity models, and programme roadmaps as standalone advisory deliverables.\nFluent English (written and spoken) is mandatory. Arabic is an advantage for client engagement across the Gulf.\nCertifications\nRelevant certifications that demonstrate depth in vulnerability management, offensive security, or cloud security are valued: GIAC GVMS, OSCP, CISM, CISSP, or cloud-specific security certifications (AWS Security Specialty, AZ-500) are all appropriate indicators.\nDevSecOps or container security certifications (AZ-400, CCSE) are a plus given the deployment environments clients typically operate in.","description_format":"text","description_chars":6444,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security"],"lifecycle":[{"event":"open","at":"2026-09-05T10:34:13Z"}],"visa":[],"liveness":{"score":1,"band":"cold","label":"Long shot","p_open":0.4,"p_active":0.092,"p_room":0.28,"age_days":270,"expected_fill_days":30,"reasons":["conf:1387","agency","stale_co","win:tail","crowd:"],"computed_at":"2026-11-02T06:13:15Z"},"pay":null,"html_url":"https://alion.io/job/guildhall-vulnerability-manager","json_url":"https://alion.io/job/guildhall-vulnerability-manager.json","meta":{"generated_at":"2026-11-02T09:10:09Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":12774,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-03T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":109894},"rest":"https://alion.io/mcp/rest/get_company?id=109894"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fguildhall-vulnerability-manager"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fguildhall-vulnerability-manager"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fguildhall-vulnerability-manager"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/guildhall-vulnerability-manager\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fguildhall-vulnerability-manager"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":242754}},{"tool":"search_jobs","arguments":{"company":"guildhall.agency","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":242754},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}