Vulnerability Management SDLC Specialist

Business Unit:  Technology Operations & Cyber Security
Salary Range: Circa £50,000 per annum DOE + red-hot benefits

Be the voice we need. Live a life more Virgin.

Our Team
Are you passionate about cyber security and eager to make a real impact?  At Virgin Money, we’re looking for a dynamic Vulnerability Management SDLC Specialist to join our busy team.

We’re establishing a new capability to work with our SDLC tooling, assessing the output and remediation activity, and collaborating with our DevOps function on integration and improvement initiatives, providing straight up advice for colleagues on security best practice and requirements.

It’s a great opportunity to work with industry-leading tools and security partners, to become a key security partner to our DevOps community to support the building of secure, high-quality applications for the Bank, while enhancing your analytical, technical and communication skills, and enabling you to really make a difference to our customers and colleagues.

What you’ll be doing

• Assess the output from vulnerability scanning on our application code and open-source libraries, providing guidance to our DevOps function on best practice, and tracking remediation
• Identify and evaluate security risks on our internal applications, making recommendations to continuously improve Virgin Money’s security posture in an ever-changing threat landscape. 
• Offer expert guidance and advice on code vulnerabilities, our policy & standards, industry regulations, frameworks, and best practices to support our DevOps function
• Support our DevOps function with a security lens, developing and maintaining reporting to support identification of key focus areas for remediation and driving forward change
• Support our Champions network for SDLC by fostering strong connections with our DevOps function, helping to shift our security culture and advocate for Secure Coding principles across our application code base.

We need you to have                                                                                     

• Knowledge of the vulnerability management lifecycle, with a good understanding of code-based vulnerabilities and dependencies, the OWASP Top 10, and minimisation of risk
• Experience of analysing and translating output from tools supporting static and/or open-source code vulnerability analysis, with an ability to conduct risk assessments and communicate remediation requirements
• Knowledge of the DevOps function in an organisation, with experience of providing security guidance on vulnerabilities, best practice and expectations
• Excellent stakeholder management skills, with the ability to manage relationships with internal technical and managerial stakeholders
• Experience of building and managing a service improvement programme, including task allocation, management and tracking, supporting resource requirements, and budget management

It’s a bonus if you have but not essential

• A background in application code development, with the ability to utilise the output from security tools to identify risk and prioritisation
• Knowledge of a vulnerability management code scanning tool
• Knowledge of Azure and cloud infrastructure

Red Hot Rewards

• Generous holidays - 38.5 days annual leave (including bank holidays and prorated if part-time)​ plus the option to buy more.
• Up to five extra paid well-being days per year​. 
• 20 weeks paid, gender-neutral family leave (52 weeks in total) for expectant parents and those looking to adopt. 
• Market-leading pension.
• Free private medical cover, income protection and life assurance.
• Flexible benefits include Cycle to Work, wellness and health assessments, and critical illness. 

And there's no waiting around, you'll enjoy these benefits from day one.

Feeling insatiably curious about this role? If we’re lucky to receive a lot of interest, we may close the advert early and would hate you to miss out.

We're all about helping you Live a Life More Virgin, so happy to talk flexible working with you.

Say hello to Virgin Money
We’re making great strides towards achieving our ambition of becoming the UK’s best digital bank.  As a full-service digital bank with a heritage stretching back over 180 years, we’re a workforce to be reckoned with, and we're putting the full power of our experience behind disruptive ideas that reinvent the role a bank plays in people's lives. We're customer-obsessed and work tirelessly to deliver on our purpose, ‘Making You Happier About Money.’ This means we're able to do banking differently, and by innovating and working together we can make a real difference by creating memorable moments and red-hot experiences for our millions of customers. Join us and Live a Life More Virgin that empowers you with choice and flexibility in how you work. 

Be yourself at Virgin Money
Our purpose is to make people happier about money, this means seeing and feeling the world as our customers do by creating a workforce that reflects the rich diversity of our customers and communities.  We’re committed to creating an inclusive culture where colleagues feel safe and inspired to contribute, speak up and be heard.  

As a Disability Confident Leader, we're committed to removing any obstacles to inclusion.  If you need any reasonable adjustments or support making your application, contact our Talent Acquisition team careers@virginmoney.com

It’s important to note that there may be occasions where it’s not possible to interview all candidates declaring a disability who meet the essential criteria for the job. In certain recruitment situations such as receiving a high-volume of applications, we may need to limit the overall numbers of interviews offered to both disabled and non-disabled applicants. 

Now the legal bit
Living A Life More Virgin allows our colleagues to be based anywhere in the UK (if the role allows it), but we'll need you to confirm you have the right to work in the UK.

If you're successful in securing a role with us, there are some checks you need to complete before starting. These include credit and criminal record checks and three years' worth of satisfactory references. If the role is part of the Senior Manager Regime and Certification Regime, it requires enhanced pre-employment checks – we'll ask for six years of regulatory references, and once in the role, you'll be subject to periodic employment checks.