Vulnerability Manager

About the role

Statkraft's CSIRT team, part of the Cyber Security Department, protects its digital infrastructure and assets from cyber-attacks. As Vulnerability Manager you will own the end-to-end vulnerability management lifecycle across the organization, defining and refining practices and standards, enforcing SLAs and empowering IT and development teams to prioritize remediation. The role focuses on governance and continuous improvement rather than running the technical scans, and requires physical presence at the main office in Lilleaker, Oslo.

Key responsibilities

• Mature the vulnerability management framework, policies and standard operating procedures
• Establish and revise frameworks for evaluating and prioritizing vulnerabilities, combining threat intelligence with business context
• Monitor and enforce vulnerability compliance across Security, Operations, Development and other departments, acting as escalation point when SLAs are breached
• Design and track KPIs, risk indicators and dashboards to report security posture and residual risks to leadership
• Lead regular meetings with system owners and business units to align remediation, manage risk acceptances and resolve resource conflicts
• Oversee the strategic direction of the vulnerability management tooling suite

Required profile

• Bachelor's or Master's degree in IT, Information Security, Computer Science or a related field (relevant experience may compensate)
• Minimum 5 years of experience in cybersecurity, information security, IT operations or technical vulnerability management
• Strong project management skills driving initiatives across matrixed, cross-functional teams without direct authority
• Fluency in spoken and written Norwegian and English
• Eligibility for Norwegian security clearance and authorization

Required skills

• Understanding of vulnerability lifecycles, threat modeling and cloud infrastructure (Azure/AWS/GCP)
• Vulnerability scanner platforms such as Tenable/Nessus, Qualys, Rapid7 or Microsoft Defender Vulnerability Management
• Nice to have: knowledge of AI and frontier AI, Prince2/PMP/CISM/CISSP or cloud security certifications, NIST CSF, ISO 27001 or CIS Controls, AppSec/DevSecOps and SAST/DAST tooling

What we offer

• Unlimited learning opportunities and a global network of experts
• Flexible working solutions and work-life balance principles
• Competitive terms of employment and benefits