Head of Vulnerability Management

Please note this role requires DV Clearance

The Government Cyber Unit's mission is to protect public services from cyber threats and digital resilience failures. We are working to achieve a step change in our cyber and digital resilience across government, through delivery of the Government Cyber Action Plan, and working closely with departments and national technical authorities including the National Cyber Security Centre to deliver. This is a challenging time to be working in cyber security and digital resilience, but we have an incredible opportunity to make a difference to people’s lives and promote national security by protecting the public services and national infrastructure they rely on. We work at the forefront of shaping the UK’s national response to emerging cyber and technology issues - from the increasingly complex range of state-sponsored cyber-attacks and supply chain compromises, through to the transformational benefits and security challenges of frontier AI and quantum computing.

We are committed to creating an inclusive and supportive working environment where people can learn, develop and do their best work. Continuous professional development and a focus on wellbeing is core to our unit culture. We welcome applications from candidates who share this ethos and are excited by our mission.

The Government Cyber Coordination Centre (GC3) coordinates the cross-Government response to cyber security vulnerabilities, threats, and incidents, and enables cyber defenders across Government to work together and to “defend as one”. The GC3 is a joint initiative sponsored by the Department for Science, Innovation and Technology (DSIT) and the National Cyber Security Centre (NCSC). This role is based in DSIT, but you should expect to work closely alongside colleagues from both sponsoring organisations, and wider Government and the public sector.

Please Note - Former DSIT recruitment campaigns are continuing as usual, but candidates should be aware that following the Government’s announcement on the changes to some civil service departments, roles will be subject to the machinery of government moves and will ultimately be in one of the new departments. We will provide more information if you are selected for a role. This work remains of high importance to the civil service, and we thank you for your continued interest.

We are looking for an experienced vulnerability management professional to set the strategic direction for vulnerability management across government and coordinate action to reduce cyber risk through the effective identification, mitigation and remediation of vulnerabilities. This role reports to the Deputy Director for Government Cyber Operations.

Responsibilities

• set the strategic direction for vulnerability management across government, leading the government’s approach to identifying, triaging, mitigating, and remediating vulnerabilities across departments
• work closely with the Government Cyber Unit’s accountability team to establish and operate governance, policy, assurance and risk/performance reporting structures for vulnerability management across government
• understand and report on government’s aggregate exposure to vulnerabilities, and performance remediating or otherwise mitigating vulnerabilities
• lead the operation of central vulnerability management services, including the Vulnerability Reporting Service (VRS) and Vulnerability Monitoring Service (VMS), ensuring delivery of a quality service that efficiently and effectively reduces risk at-scale, and driving continuous improvement
• work closely with the Government Cyber Unit’s Services team to build and continually improve central vulnerability management services, providing SME input and direction for the product roadmap
• work closely with the GC3 Incident Management function to support the cross-government response to critical vulnerabilities, enabling a rapid understanding of risk, clear communications to decision makers, and a coordinated and informed response across government
• support teams across DSIT and the NCSC working to reduce vulnerabilities at source, both through improving underlying technology and reducing the attack surface
• advise ministers, senior officials, and IT and cyber security leadership across government on the risk from vulnerabilities, and the operational response to these
• engage closely with stakeholders and customers across government, including wider DSIT, the NCSC, and departmental IT and cyber security teams
• line manage lead analysts in the vulnerability management team, and provide coaching and support to staff across the GC3

The post holder may be required to support out of hours on call rotas for responding to cyber and digital resilience incidents, for which remuneration and/or flexible working arrangements will be available.

Open to UK nationals only.

The standard selection process for roles at DSIT consists of:

• a simple application screening process - We only ask for a CV. Your CV will be assessed against the essential criteria - significant experience leading vulnerability management in a large, complex organisation, and a deep understanding of vulnerabilities and vulnerability management practices
• A 20 minute technical phone screen
• a 60 minute video interview

While we value the use of AI technology to enhance our daily work, we also value the personal touch and urge applicants to write cover letters without the use of AI to emphasise their own unique experiences.

In the Civil Service, we use Success Profiles to evaluate your skills and ability. This gives us the best possible chance of finding the right person for the job, increases performance and improves diversity and inclusivity. We’ll be assessing your technical abilities, skills, experience and behaviours that are relevant to this role.

For this role we’ll be assessing you against the following Civil Service Behaviours:

• Leadership
• Delivering at pace
• Making effective decisions
• Communicating and influencing

We’ll also be assessing your experience and specialist technical skills against the following skills defined in the Government Cyber Capability Framework for the Vulnerability Management - Principal role

• Cyber security operations (Practitioner)
• Information risk assessment and risk management (Practitioner)
• Legal and regulatory environment and compliance (Awareness)

Recruitment Timeline

Sift completion: 6th October 2026

Panel interviews: Starting from 13th October 2026

Candidates that do not pass the interview but have demonstrated an acceptable standard may be considered for similar roles at a lower grade.

A reserve list will be held for a period of 12 months, from which further appointments can be made.

The Civil Service is committed to attract, retain and invest in talent wherever it is found. To learn more please see the Civil Service People Plan and the Civil Service D&I Strategy.

Sponsorship

DSIT cannot offer Visa sponsorship to candidates through this campaign. DSIT holds a Visa sponsorship licence but this can only be used for certain roles and this campaign does not qualify.

Security

Please note, this role requires Developed Vetting level of clearance (DV).

DV is required when an individual has long term, frequent and uncontrolled access to ‘Top Secret’ (Information that could directly threaten the national security of the UK, cause long-term damage to our economy or lead to widespread loss of life) information.

To gain DV clearance an applicant will normally need to have been a UK resident for a minimum of 10 years. There are several stages to the vetting process which usually takes 6 month +:-

• SC Level Clearance
• Completion of a DV supplementary questionnaire
• Completion of a financial questionnaire
• A review of the candidate’s personal finances
• A medical and psychological assessment
• Interviews with the candidates referees
• A detailed interview with the candidate

More information on DV clearance is linked here

Nationality Requirements - Further Information for Candidates

1. This post is classed as ‘Reserved’ as per Civil Service Nationality RulesSection 3. In accordance with these rules, ‘only UK nationals may be employed in reserved posts in the Civil Service’1 (Paragraph. 3.1).

UK National Definition

2. The definition of a ‘UK National’ can be found at Paragraphs. 1.4-1.8 of the Civil Service Nationality Rules.

Dual Nationals

3. As per Paragraph. 1.41 of the Civil Service Nationality Rules:

4. ‘Candidates with dual nationality are in principle eligible for employment in the Civil Service provided that they meet the requirements in relation to one of their nationalities [i.e. UK National]. They may not be eligible, however, for employment in certain reserved posts where additional nationality requirements are imposed.’

Additional Restrictions for Reserved Posts

5. As per Paragraphs. 3.10-3.11 of the Civil Service Nationality Rules:

6. ‘…departments and agencies are entitled to impose additional requirements in reserved posts if this is considered necessary. This could include, for example, requirements as to the residency of the applicant or the nationality of one or both parents of the applicant.’

7. If you are a Dual National who possesses UK Nationality and wish to check your eligibility for the post, please contact our recruiting team at the details below. Please be advised that we will not be able to provide a justification for our decision for security reasons.

8. Irish nationals and Commonwealth citizens are also eligible for employment in reserved posts if they were in the Civil Service at 31 May 1996 or before, or were appointed from a recruitment scheme with a closing date for receipt of applications before 1 June 1996. (Paragraph. 3.1)

Please note offers of employment are subject to achieving satisfactory pre-employment and security checks. These include an Occupational Health Assessment and a Disclosure and Barring Service (DBS). As part of this you will need to confirm your identity, employment/education history, nationality and any criminal record (unspent convictions only).

Feedback will only be provided if you attend an interview or assessment.