Vulnerability Management Lead

Bridge351 is hiring for a leading European banking group in Brussels. You'll help turn vulnerability management into a risk-based, measurable process. Today the organisation finds vulnerabilities. You'll make sure the right ones get fixed first, back it up with clear numbers, and show the trend to management. This is a hands-on improvement role. You will redesign the end-to-end process, set up the governance around it, and build the reporting that IT teams, risk owners and leadership actually use. WHAT YOU WILL DO Process design and improvement
• Assess the current vulnerability lifecycle (discovery, triage, prioritisation, remediation, verification, closure) and identify gaps
• Design and roll out a target process with clear roles (RACI), workflows and handovers between Security and IT
• Industrialise risk-based prioritisation using contextual data
• Implement remediation SLAs and an exception / risk-acceptance process
• Improve scan coverage and asset inventory alignment so no critical asset is left unscanned Reporting and metrics
• Define KPIs and KRIs: scan coverage, mean time to remediate, SLA compliance, critical exposure, ageing backlog
• Build dashboards for remediation teams, management and executives (CISO, risk committee, board)
• Automate data collection and reporting, replacing manual spreadsheet work
• Turn the numbers into clear trends and recommendations Governance and stakeholders
• Write or update the vulnerability management policy, standards and procedures
• Align the process with ISO 27001, NIST CSF, CIS Controls and NIS2
• Drive the change on the ground and coach teams on prioritisation and remediation
• Integrate vulnerability data with the CMDB for automatic assignment and tracking WHAT WE ARE LOOKING FOR
• 6+ years in IT or information security, including 3+ years in vulnerability management
• Proven experience designing or improving a security process end to end, not only running it
• Hands-on experience with an enterprise scanning platform (Tenable, Qualys, Rapid7, Tanium)
• Strong understanding of CVSS, exploitability data and risk-based prioritisation
• Experience building security dashboards (Power BI, Tableau, Splunk or VM platform reporting)
• Solid technical knowledge of operating systems, networks, cloud and application stacks
• Familiarity with ISO 27001, NIST CSF or CIS Controls, and with NIS2
• Experience in a regulated sector (financial services, energy, healthcare)
• Master's degree
• Excellent English, and the ability to understand business conversations in French NICE TO HAVE
• Banking experience
• Scripting or automation (Python, PowerShell) and platform APIs
• ServiceNow Vulnerability Response or a similar workflow tool
• Project or change management (ITIL, Prince2, Agile)
• CISSP, CISM or CRISC certification WHAT MAKES YOU SUCCEED HERE
• You prefer a simple process that people follow over a perfect one that nobody uses
• You are data-driven and can tell a clear story with numbers
• You get things done through teams you don't manage LOCATION AND WORK MODEL Brussels, Belgium – hybrid (50% on site, 50% remote). Relocation candidates are welcome. What can you expect from us? Mind-blowing workplace culture. You will be integrated in a professional, dynamic and collaborative team. 100% Remote opportunities We want you to have the flexibility to work where you feel most comfortable and productive. International Career
• You can expect professional growth and to be connect with the world.
• We are represented in Portugal, Belgium, Luxembourg, and Denmark.
• And with projects in many other countries: Netherlands, Luxembourg, Singapore and in the United States of America (and a lot more is coming…) Extra Benefits & Perks If you wish to work with us and you are outside European Union (good news…) we are a Tech Visa Company, We will help As a plus, we provide Health and Life Insurance.