Information Security Vulnerability Management Officer — EFG International AG

Full description

General Info

• Department: Information Security & BCM – Information Security Management
• Work time Percentage: 100%
• Location: Geneva

Our Company

Our Purpose and Mission

Job Description

We are looking for an experienced Director-level Information Security professional to join our Information Security Management team as Information Security Vulnerability & Management Officer . In this senior individual contributor role, you will lead EFG’s vulnerability and exposure management capability, driving a risk-based, end-to-end approach to identifying, assessing and remediating technical vulnerabilities across the bank’s technology landscape.

You will design and continuously enhance the vulnerability management framework, processes and tooling, and provide strong oversight and challenge of remediation activities performed by IT infrastructure, application and platform teams. Operating with a high degree of autonomy, you will translate complex technical findings into clear, business-relevant risk insights and influence risk owners and senior stakeholders to align remediation priorities with the bank’s risk appetite over a 1–3 year horizon.

In addition, you will support the broader ICT risk management framework by conducting ICT risk assessments and contributing expert input to the bank’s information security and technology risk posture.

Key Responsibilities

• Design and evolve the end-to-end, risk-based vulnerability and exposure management framework, defining requirements for processes and tooling, identifying gaps and maintaining a multi-year roadmap to mature the capability.
• Lead the full vulnerability management lifecycle , from intake, analysis and risk assessment through to remediation prioritisation, tracking with IT teams, reporting, and formal escalation and risk acceptance of critical vulnerabilities.
• Define, monitor and challenge key performance and risk indicators (KPIs/KRIs) for vulnerability management (e.g. scan coverage, remediation timelines, residual risk exposure), using metrics to drive accountability and continuous improvement with IT and risk owners.
• Drive risk-based remediation prioritisation by working closely with IT infrastructure teams, application owners and risk owners to agree remediation approaches and timelines that align with the bank’s risk appetite and regulatory expectations.
• Plan and oversee periodic vulnerability scans and assessments on internal environments and the external perimeter, ensuring coverage is in line with defined requirements, technology scope and emerging threats.
• Challenge and support IT and application teams on timely remediation of vulnerabilities and configuration deviations, facilitating remediation planning workshops, tracking progress and proactively removing obstacles to closure.
• Prepare and present clear vulnerability management reports and dashboards for relevant governance bodies and senior stakeholders, ensuring ownership, deadlines and action plans for risks outside the bank’s risk appetite.
• Identify and implement opportunities to enhance vulnerability management through AI, advanced analytics and automation, including automated workflows for vulnerability analysis, prioritisation and remediation follow-up.
• Conduct ICT risk assessments on emerging threats, vulnerabilities and technology changes, and provide expert recommendations for risk treatment across IT, information security, third-party and data-related risks.
• Translate complex technical vulnerabilities and remediation gaps into concise business impact narratives for senior stakeholders, enabling informed decisions on risk acceptance, investment and prioritisation.

Requirements and Qualifications

Education

• Minimum: Bachelor’s degree in Computer Science, IT Engineering, Cybersecurity or a closely related field, or equivalent professional experience.
• Preferred: Master’s degree in Information Security, Cybersecurity or a related discipline is an advantage.

Professional Certifications / Licences

• Relevant information security certifications are highly desirable, such as CISSP, CISM, CISA, GIAC or equivalent qualifications in information security and/or ICT risk.

Professional Experience

• At least 10 years of relevant experience in information security, with a strong focus on vulnerability management within a complex IT environment, preferably in financial services.
• Proven experience in designing and operating vulnerability management frameworks , including processes, tooling and reporting in a regulated environment.
• Demonstrated experience in conducting information security or ICT risk assessments and contributing to risk treatment and risk acceptance decisions.
• Track record of influencing senior stakeholders and risk owners on remediation priorities, using data-driven insights and clear risk narratives.
• Experience working closely with IT infrastructure, application and platform teams, ideally in environments using modern delivery practices (Agile, CI/CD, DevOps).

Technical / Functional Knowledge

• Strong working knowledge of recognised vulnerability and patch management standards and guidelines (e.g. NIST SP 800-40, SANS guidance on threat and vulnerability assessment and managing security vulnerabilities).
• In-depth understanding of vulnerability management tools, technologies and processes, including vulnerability scanners, configuration assessment tools and related reporting solutions.
• Solid technical understanding of vulnerability and malware analysis, with the ability to assess risk and distinguish between high-impact issues and low-risk findings.
• Good understanding of patch management processes in large organisations and how to support IT teams in ensuring systems are patched in line with risk, criticality and business constraints.
• Strong technical appetite and capability to deep dive into vulnerability scanner configuration, coverage and limitations, and to interpret scan results across operating systems, network devices and applications.
• Familiarity with modern delivery practices (Agile, CI/CD, DevOps) and the ability to challenge how vulnerabilities, obsolescence and patch deployment are managed across the software lifecycle, ensuring remediation is embedded in delivery pipelines.
• Experience in monitoring external sources such as security advisories, specialised forums and communities of practice to identify relevant vulnerabilities and feed the vulnerability management process.

Behavioural and Interpersonal Skills

• Excellent communication skills, with the ability to explain complex technical findings clearly to both technical and non-technical audiences.
• Strong influencing and stakeholder management skills, with the ability to challenge constructively when risk is not adequately addressed and to drive alignment with the bank’s risk appetite.
• High level of analytical thinking, problem-solving and sound risk judgement, operating with significant autonomy within the Information Security & BCM function.

Languages

• English: Fluent (spoken and written).
• French or Italian: Considered an advantage.

Our Values

• Accountability: Taking ownership for tasks and challenges, as well as seeking continuous improvement
• Hands-on: Being proactive to rapidly deliver high-quality results
• Passionate: Being committed and striving for excellence
• Solution-driven: Focusing on client outcomes and treating clients fairly with a risk-aware mindset
• Partnership-oriented: Promoting collaboration and teamwork. Working together with an entrepreneurial spirit.

Questions about this listing