> Markdown version of [/jobs/ext/2392173-senior-cyber-threat-vulnerability-governance-manager](https://www.wearedevelopers.com/jobs/ext/2392173-senior-cyber-threat-vulnerability-governance-manager). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Cyber Threat & Vulnerability Governance Manager - **Company:** Metro Bank - **Location:** London, UK - **Experience:** Expert - **Salary:** £67,438.0 - **Contract:** Permanent contract - **Skills:** Active Directory, Artificial Intelligence, Amazon Web Services, Microsoft Azure, Computer Telephony Integration, Information Leak Prevention, Linux, Information Technology Operations, Open Source Intelligence, Security Information and Event Management, Software Vulnerability Management, Cloud Platform System, Large Language Models, Mitre Att&ck, Cyber Threat Analysis, Vulnerability Analysis - **Published:** August 14, 2026 - **Apply:** https://www.adzuna.co.uk/jobs/details/5840050274 ## About the Role * A minimum of 8 years of experience in cybersecurity, threat analysis, or intelligence operations * Strong understanding of regulatory compliance (e.g. FCA/PRA rules) * Strong understanding of threat actor behaviors, MITRE ATT&CK & D3FEND frameworks, and threat intelligence platforms * Knowledge of Windows, Linux, Active Directory, and cloud environments (Azure, AWS) * Strong knowledge of vulnerability scanning tools, threat analysis methodologies, and remediation processes * Knowledge of AI-specific attack vectors and experience with secure AI lifecycle practices. * Recognised industry qualification e.g. CISSP, CISMP, CCSP, CISM * Experience with OSINT tools, and reporting for both technical and executive audiences is highly desirable. * Excellent analytical and problem-solving skills. * Strong stakeholder management skills and the ability to work within cross-functional teams and influence remediation priorities * Proven experience in proactive threat hunting within SIEM platforms and enterprise environments, leveraging advanced analytics and detection methodologies to identify and mitigate potential security threats before they escalate ## Description * Design, develop, and maintain a comprehensive internal and external threat framework covering cyber, physical, supplier, and emerging threats * Manage a repeatable methodology for identifying, assessing, prioritising, and tracking threats across the organisation * Integrate intelligence from internal telemetry, SOC outputs, CTI, red/purple teaming, suppliers, and industry sources into the threat framework * Ensure the framework aligns with relevant standards (e.g., MITRE ATT&CK ATLAS, NIST 800-53/800-30, ISO 27005) * Drive continuous improvement by refining threat models based on real incidents, trend analysis, and threat landscape shifts * Design and define and implement governance processes for vulnerability management across all hardware, software, cloud, and operational technology assets * Analyze scan results, prioritize vulnerabilities based on threat context and business impact, and track remediation progress * Design and develop clear accountability models (RACI) across Security, IT Operations, Engineering, and Product teams * Own and lead governance forums to monitor vulnerability status, risk posture, and remediation performance * Maintain a scalable, intelligence led triage process to assess new vulnerabilities (CVEs, zero days, vendor advisories, threat intel alerts). Introduce prioritisation logic based on factors such as: exploitability, asset criticality, exposure (internal vs external), compensating controls and business impact * Lead identification and assessment of risks associated with frontier AI technologies (e.g. large language models, autonomous agents, multimodal systems), ensuring emerging threat scenarios such as prompt injection, model exploitation, data leakage, and AI-enabled cyber attacks are proactively understood and documented. ## Related Videos - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Developer Tools for Microsoft Azure](https://www.wearedevelopers.com/videos/450-developer-tools-for-microsoft-azure) - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) - [Getting under the skin: The Social Engineering techniques](https://www.wearedevelopers.com/videos/38-getting-under-the-skin-the-social-engineering-techniques) - [Develop enterprise-ready applications for Microsoft Teams with Azure resources on modern web technologies](https://www.wearedevelopers.com/videos/187-develop-enterprise-ready-applications-for-microsoft-teams-with-azure-resources-on-modern-web-technologies) - [Docker exec without Docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk) - [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents) - [Best Companies to work for in London: Top 25 Companies in 2023](https://www.wearedevelopers.com/magazine/187-best-companies-to-work-for-in-london-top-25-companies-in-2023) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)