TVM Analyst

Overview

In this role you will strengthen Primark’s Threat and Vulnerability Management by identifying, prioritising and tracking security vulnerabilities across a global tech estate. You will work with cross-functional teams to coordinate remediation aligned with business risk and cyber security objectives. The position sits in the Cyber team, focusing on reducing cyber risk and driving remediation across cloud, on-premises and third-party sources. This is an opportunity to influence secure technology delivery at scale and partner with external suppliers to uphold strong cyber hygiene.

Responsibilities

• Identify, analyse, prioritise and report vulnerabilities across Primark’s technology environment
• Operate vulnerability management processes across vulnerability scanning, cloud posture, application security and third-party data sources
• Assess vulnerabilities using severity, exploitability, exposure, asset criticality and business context
• Coordinate remediation activities with infrastructure, application, cloud and third-party teams
• Monitor remediation progress against agreed SLAs and escalate high-risk or overdue issues
• Produce reporting on vulnerability trends, remediation performance and key cyber risk areas
• Validate remediation evidence and support retesting activities to confirm vulnerabilities have been effectively addressed

Key requirements

• 2+ years’ experience within cyber security, vulnerability management or security operations
• Experience assessing and prioritising vulnerabilities using a risk-based approach
• Hands-on experience with vulnerability scanning, remediation tracking and validation processes
• Strong understanding of cyber risk, vulnerability lifecycles and remediation best practices
• Ability to collaborate effectively with technical teams and external suppliers
• Experience with vulnerability management tools such as Tenable, Qualys, Rapid7 or Microsoft Defender Vulnerability Management is advantageous
• Relevant cyber security certifications such as Security+, CySA+ or equivalent are desirable

• collaboration
• communication
• analytic thinking
• vulnerability scanning
• remediation tracking
• validation processes

…