Information Security Vulnerability Management Officer

About the role

EFG International, a global private banking group, is looking for an experienced Information Security professional to join its Information Security Management team as Information Security Vulnerability & Management Officer in Geneva. This is a senior individual contributor role leading the bank's vulnerability and exposure management capability, with a risk-based, end-to-end approach to identifying, assessing and remediating technical vulnerabilities. You will design and improve the vulnerability management framework, oversee remediation by IT, application and platform teams, and support the broader ICT risk management framework.

Key responsibilities

• Design and evolve the end-to-end, risk-based vulnerability and exposure management framework, including processes, tooling and a multi-year roadmap.
• Lead the full vulnerability management lifecycle: intake, analysis, risk assessment, remediation prioritisation, tracking, reporting and formal escalation and risk acceptance of critical vulnerabilities.
• Define, monitor and challenge KPIs and KRIs such as scan coverage, remediation timelines and residual risk exposure.
• Plan and oversee periodic vulnerability scans and assessments of internal environments and the external perimeter.
• Work with IT infrastructure, application and platform teams to agree remediation approaches and timelines aligned with the bank's risk appetite and regulatory expectations.
• Prepare and present vulnerability management reports and dashboards for governance bodies and senior stakeholders.
• Identify opportunities to improve the capability through AI, advanced analytics and automation, and conduct ICT risk assessments on emerging threats and technology changes.

Required profile

• Bachelor's degree in Computer Science, IT Engineering, Cybersecurity or a related field, or equivalent experience; a Master's is an advantage.
• At least 10 years of information security experience, with a strong focus on vulnerability management in a complex IT environment, preferably in financial services.
• Proven experience designing and running vulnerability management frameworks in a regulated environment, and conducting ICT risk assessments.
• Track record of influencing senior stakeholders and risk owners on remediation priorities.
• Experience with IT infrastructure, application and platform teams, ideally in Agile, CI/CD and DevOps environments.
• Fluent English; French or Italian considered an advantage.

Required skills

• Knowledge of vulnerability and patch management standards such as NIST SP 800-40 and SANS guidance.
• In-depth understanding of vulnerability scanners, configuration assessment tools and reporting solutions.
• Solid understanding of vulnerability and malware analysis, and of patch management in large organisations.
• Familiarity with security advisories, forums and communities of practice.