• Assess the existing Threat & Vulnerability Management capability, including current tools, processes, data sources and operating practices.
• Review the effectiveness and utilisation of existing technologies, including Microsoft Defender, AppCheck and other vulnerability management solutions.
• Evaluate current vulnerability identification, prioritisation, reporting, remediation tracking and governance processes.
• Assess the capability, identifying gaps and opportunities for maturity improvement.
• Review stakeholder engagement, ownership, accountability and the effectiveness of relationships between security, IT and remediation teams.
• Consider dependencies on centrally provided Microsoft services and the effectiveness of the associated operating model.
• Evaluate whether the existing vulnerability scanning tools remain fit for purpose or whether alternative solutions could deliver measurable improvements.
• Produce a clear, prioritised set of recommendations and a practical roadmap to improve TVM maturity, efficiency and security outcomes.

• Strong background in Threat & Vulnerability Management, with experience assessing, designing or improving TVM capabilities.
• Demonstrable experience conducting vulnerability management maturity assessments, gap analyses or capability reviews.
• Strong understanding of CIS Controls
• Experience working with vulnerability scanning and management technologies such as Microsoft Defender Vulnerability Management, AppCheck, Qualys, Tenable, Rapid7 or similar.
• Good understanding of risk-based vulnerability prioritisation, remediation governance and security reporting.
• Ability to evaluate the effectiveness of existing processes and tools, rather than simply their technical configuration.
• Experience working across security, infrastructure, application and IT operations teams.
• Strong stakeholder engagement, analytical and communication skills, with the ability to translate findings into clear, actionable recommendations.

• Map resilience capabilities against scenarios, testing and assurance activity to identify coverage, maturity and gaps.
• Support the planning and execution of extreme but plausible scenario testing, including internal, joint and industry exercises.
• Manage vulnerabilities, risks and issues identified through resilience testing and assurance.
• Help develop continuous improvement plans based on testing and assurance findings.
• Produce clear, high-quality reporting on response and recovery capability for Executive and Board-level stakeholders.
• Manage relationships with Disaster Recovery, Business Continuity and Crisis Management service providers.
• Agree service scope, service levels, deliverables and performance expectations with internal and external partners.
• Define meaningful metrics and benchmarking to demonstrate service performance and resilience capability.
• Constructively challenge service owners and partners where performance falls below agreed expectations.
• Develop and maintain capability and assurance frameworks supporting Important Business Services.

• Disaster Recovery (DR) 
• Business Continuity Management (BCM) 
• Crisis Management 
• Operational Resilience testing and scenario exercises 
• Important Business Services 
• Resilience capability and assurance frameworks 
• Risk, vulnerability and issue management 
• Regulatory and industry resilience requirements

#LI-DNI

• Lead and support the analysts, helping the team manage its workload and maintain a consistent service.
• Oversee vulnerability scanning and monitoring, identifying gaps in coverage or data quality.
• Prioritise findings using severity, threat intelligence, asset importance and business context.
• Work with technology teams to agree remediation plans and track progress.
• Follow up on overdue actions, escalate significant risks and manage exceptions.
• Provide clear reporting on vulnerabilities, remediation progress and areas of exposure.
• Keep the existing processes and tooling working well, making practical improvements where needed.

• Strong experience running a vulnerability management service in a complex organisation.
• Experience leading or coordinating vulnerability analysts.
• Good technical understanding of scanning, asset coverage, risk prioritisation and remediation.
• The ability to turn scan results into clear actions for technology teams.
• A dependable, organised approach and the confidence to follow up on actions.
• Experience with Tenable would be useful, but the priority is someone who can manage the service and team effectively.

• Work with consulting leads and client teams to understand the scope of an engagement, the expertise needed and when support is required.
• Help shape resourcing plans for new and existing client work, including the mix of skills, availability and budget.
• Build and maintain a trusted network of specialist contractors and associates who can support i-Confidential’s services.
• Identify and assess associates through direct search, referrals and existing relationships, with a focus on relevant experience and fit for the engagement.
• Give colleagues an honest view of market availability, rates and the strengths and limitations of potential associates.
• Introduce suitable people to client and delivery teams, coordinate discussions and keep everyone informed as decisions are made.
• Support rate discussions, onboarding, extensions and future assignments for associates working with i-Confidential.
• Stay close to associates during engagements, understand their availability and identify opportunities to work together again.
• Keep resourcing plans, associate information and upcoming availability accurate and up to date.

• Experience resourcing specialist contractors or associates across technology, cyber security, risk or change.
• Ability to understand a client challenge and identify the skills needed to address it.
• Strong direct sourcing, relationship building and candidate assessment skills.
• Confidence discussing specialist skills, market availability, rates and contract arrangements.
• Sound judgement when assessing whether someone is right for a client engagement.
• Clear communication and the ability to work closely with consulting leads, client teams and associates.
• Strong organisation skills and the ability to manage several resourcing needs at once.