Vulnerability and Patch Manager

Role overview

Vulnerability and Patch Manager at Expleo

Responsibilities

• You will not have access to the client's operational systems or data and will not make live changes.
• Maintain the vulnerability exception and risk acceptance register and present items for decision through service governance.

Required qualifications

• Vulnerability management vendor certification, e.g. Rapid7, Tenable or Qualys (at least one required).

Employment details

• Location: Chennai [India]

Application details

• Consolidate patch and upgrade status reporting for firewalls, intrusion prevention, email gateway, secure web gateway and application control platforms.
• Apply safe practice for operational technology (OT) assets, where scanning and patching are constrained.

About the employer

• Expleo is a trusted partner for end-to-end, integrated engineering, quality services, and management consulting for digital transformation.
• The service is governed by Expleo in the UK, with a 24/7 UK Security Operations Centre delivered by a specialist partner and an Expleo consultancy team in India providing design, engineering and assurance expertise across the client's security tooling estate.
• Support the growth of Expleo's Cybersecurity Practice through knowledge sharing and technical contribution.

Additional role details

• We help businesses harness technological change to deliver innovation, improve resilience, and support the secure delivery of complex products, platforms, and systems.
• As part of the Expleo UK Cybersecurity Practice, you will join a managed Cyber Operations service for a major UK energy network operator that forms part of the UK's Critical National Infrastructure (CNI).
• As Vulnerability and Patch Manager , you will lead the vulnerability intelligence, prioritisation and patch advisory service across the client's server, end-user, network and security device estate, coordinating remediation through the client's operational teams and suppliers.
• This is a design, review and advisory role.
• You will work within Expleo's offshore consultancy team, outside the client's operational environment.
• Operational changes are implemented by UK-based, security-cleared personnel; your work provides the designs, analysis, recommendations and assurance that those changes depend on.
• You will work from information released to the team through Expleo's controlled UK service boundary.
• Responsibilities Lead a continuous vulnerability assessment programme, using outputs from the client's vulnerability management platform released through the UK service boundary.
• Prioritise vulnerabilities using threat-informed criteria (CVSS, EPSS, CISA KEV, NCSC advisories and vendor PSIRTs) and produce monthly remediation recommendations.
• Issue critical patch advisories, typically within 24 hours, based on client guidance and credible threat intelligence, to enable expedited remediation by UK-based personnel and client suppliers.
• Produce a monthly report on vendor patch and firmware releases across the server, end-user, mobile, network and security estate.
• Produce OS patch and device firmware compliance reports.
• Track intrusion prevention signature (digital vaccine) compliance against the 48-hour target, working with the Security Engineer | Network.
• Prepare and co-facilitate the monthly vulnerability and patch review with the UK Head of Service, client teams and third-party suppliers.
• Carry out targeted vulnerability analysis in support of incidents and investigations when directed.
• Degree in computer science, cybersecurity or a related discipline, or equivalent professional experience.
• CompTIA CySA+, PenTest+, GIAC GEVA, or ITIL 4 Foundation would be advantageous.
• Vulnerability management platforms (e.g. Rapid7 InsightVM, Tenable, Qualys) and interpretation of their outputs.
• Patch management processes and tooling (e.g. Intune/MECM, Ivanti, Tanium, BigFix).
• Threat-informed prioritisation using CVSS, EPSS, CISA KEV and vendor advisories.
• Coordinating remediation across internal teams and third-party suppliers.
• Strong reporting and data analysis (Excel, Power BI).
• Clear, concise written advisories for technical and non-technical audiences. 8-12 years in IT security or infrastructure, including 4+ years managing vulnerability and patch management programmes.
• Experience running risk exception and acceptance processes through governance.