Vulnerability and Patch Manager

Expleo is a trusted partner for end-to-end, integrated engineering, quality services, and management consulting for digital transformation. We help businesses harness technological change to deliver innovation, improve resilience, and support the secure delivery of complex products, platforms, and systems.

As part of the Expleo UK Cybersecurity Practice, you will join a managed Cyber Operations service for a major UK energy network operator that forms part of the UK's Critical National Infrastructure (CNI). The service is governed by Expleo in the UK, with a 24/7 UK Security Operations Centre delivered by a specialist partner and an Expleo consultancy team in India providing design, engineering and assurance expertise across the client's security tooling estate.

As Vulnerability and Patch Manager, you will lead the vulnerability intelligence, prioritisation and patch advisory service across the client's server, end-user, network and security device estate, coordinating remediation through the client's operational teams and suppliers.

• →Lead a continuous vulnerability assessment programme, using outputs from the client's vulnerability management platform released through the UK service boundary.
• →Prioritise vulnerabilities using threat-informed criteria (CVSS, EPSS, CISA KEV, NCSC advisories and vendor PSIRTs) and produce monthly remediation recommendations.
• →Issue critical patch advisories, typically within 24 hours, based on client guidance and credible threat intelligence, to enable expedited remediation by UK-based personnel and client suppliers.
• →Produce a monthly report on vendor patch and firmware releases across the server, end-user, mobile, network and security estate.
• →Produce OS patch and device firmware compliance reports.
• →Consolidate patch and upgrade status reporting for firewalls, intrusion prevention, email gateway, secure web gateway and application control platforms.
• →Track intrusion prevention signature (digital vaccine) compliance against the 48-hour target, working with the Security Engineer | Network.
• →Maintain the vulnerability exception and risk acceptance register and present items for decision through service governance.
• →Prepare and co-facilitate the monthly vulnerability and patch review with the UK Head of Service, client teams and third-party suppliers.
• →Carry out targeted vulnerability analysis in support of incidents and investigations when directed.
• →Apply safe practice for operational technology (OT) assets, where scanning and patching are constrained.
• →Support the growth of Expleo's Cybersecurity Practice through knowledge sharing and technical contribution.

• Degree in computer science, cybersecurity or a related discipline, or equivalent professional experience.
• Vulnerability management vendor certification, e.g. Rapid7, Tenable or Qualys (at least one required).
• CompTIA CySA+, PenTest+, GIAC GEVA, or ITIL 4 Foundation would be advantageous.

• Vulnerability management platforms (e.g. Rapid7 InsightVM, Tenable, Qualys) and interpretation of their outputs.
• Patch management processes and tooling (e.g. Intune/MECM, Ivanti, Tanium, BigFix).
• Threat-informed prioritisation using CVSS, EPSS, CISA KEV and vendor advisories.
• Coordinating remediation across internal teams and third-party suppliers.
• Strong reporting and data analysis (Excel, Power BI).
• Clear, concise written advisories for technical and non-technical audiences.

• OT vulnerability management and safe scanning practice.
• Energy, utilities or other CNI sector experience.
• Experience supporting NIS or CAF-aligned assurance reporting.

• 8-12 years in IT security or infrastructure, including 4+ years managing vulnerability and patch management programmes.
• Experience running risk exception and acceptance processes through governance.

• Have the right to work in India.
• Be based in, or willing to relocate to, Chennai.
• Be willing to complete Expleo enhanced pre-employment background screening (equivalent in standard to the UK Baseline Personnel Security Standard) and any additional vetting the client requires.
• Be able to work hours that overlap with the UK business day, with occasional out-of-hours advisory support during major incidents.
• Have excellent written and spoken English, suitable for engagement with senior UK stakeholders.
• Be comfortable working within a strict security boundary, with no access to the client's operational systems or data.