Threat & Vulnerability Management Specialist

We are looking for an experienced Threat & Vulnerability Management Specialist to undertake a short-term engagement reviewing existing vulnerability management capability and identifying opportunities to improve its effectiveness, maturity and overall security outcomes. This is an assessment and advisory engagement, requiring someone who combines strong technical knowledge of vulnerability management with the ability to challenge existing practices, engage stakeholders and develop pragmatic recommendations for improvement.

• Assess the existing Threat & Vulnerability Management capability, including current tools, processes, data sources and operating practices.
• Review the effectiveness and utilisation of existing technologies, including Microsoft Defender, App Check and other vulnerability management solutions.
• Evaluate current vulnerability identification, prioritisation, reporting, remediation tracking and governance processes.
• Assess the capability, identifying gaps and opportunities for maturity improvement.
• Review stakeholder engagement, ownership, accountability and the effectiveness of relationships between security, IT and remediation teams.
• Consider dependencies on centrally provided Microsoft services and the effectiveness of the associated operating model.
• Evaluate whether the existing vulnerability scanning tools remain fit for purpose or whether alternative solutions could deliver measurable improvements.
• Produce a clear, prioritised set of recommendations and a practical roadmap to improve TVM maturity, efficiency and security outcomes.

• Strong background in Threat & Vulnerability Management, with experience assessing, designing or improving TVM capabilities.
• Demonstrable experience conducting vulnerability management maturity assessments, gap analyses or capability reviews.
• Strong understanding of CIS Controls
• Experience working with vulnerability scanning and management technologies such as Microsoft Defender Vulnerability Management, App Check, Qualys, Tenable, Rapid7 or similar.
• Good understanding of risk-based vulnerability prioritisation, remediation governance and security reporting.
• Ability to evaluate the effectiveness of existing processes and tools, rather than simply their technical configuration.
• Experience working across security, infrastructure, application and IT operations teams.
• Strong stakeholder engagement, analytical and communication skills, with the ability to translate findings into clear, actionable recommendations.

• We are particularly interested in consultants who have previously helped organisations transform or mature their vulnerability management capabilities, rather than those whose experience is primarily operational.
• You will be comfortable challenging existing approaches, identifying where activity is not delivering meaningful risk reduction and recommending sensible improvements that can be delivered within realistic organisational and resource constraints.
• The successful consultant will be technically credible, commercially aware and capable of working independently to produce a practical, outcome-focused improvement plan.