Vulnerability Management Engineer - Met Office

We’re looking for an exceptional Vulnerability Management Engineer to help us make a difference to our planet.

As our Vulnerability Management Engineer, the job may be suitable for hybrid working, which is where an employee works part of the week in the office and part of the week from home. This is a voluntary, non-contractual arrangement and the location advertised will be your contractual place of work.

Our opportunity is full time, 37 hours per week. Our people are at the heart of what we do and we'll do our best to agree a working pattern that works for everyone.

World changing work

From science to technology, from meteorology to management, and from planning to communication, our expertise helps us stand out as the authority on weather accuracy and climate prediction. We help individuals, industries and government to make better decisions to stay safe and thrive. This is the Met Office. This is who we are.

• We’re a force for good - focusing on our environmental and social impact
• We’re experts by nature - always learning and developing to do things better
• We live and breathe it - putting our purpose at the heart of decision-making
• We’re better together - understanding partnerships and inclusivity make us greater
• We keep evolving - pushing boundaries to make tomorrow better for our customers

Your world of expertise

As a Vulnerability Management Engineer, you will play a key role in protecting the organisation’s systems, data, and services by identifying, analysing, and driving the remediation of vulnerabilities across our IT estate. You will operate within the Cyber Security Operations function, working closely with IT Operations, SOC, and development teams to ensure vulnerabilities are effectively prioritised and resolved in line with risk and service level agreements. You will configure and operate enterprise vulnerability scanning tools across networks, servers, endpoints, applications, and cloud environments.

You will assess vulnerabilities using risk-based approaches, combining CVSS scoring with asset criticality and threat intelligence to determine real-world impact. You will act as a trusted advisor to technical teams and stakeholders, providing clear guidance on remediation actions and communicating complex risk in an understandable way to support decision-making.

Your key duties :

• Plan, configure, and execute vulnerability scans across enterprise environments including cloud and on-premise systems.
• Analyse vulnerabilities to determine severity, exploitability, and business impact using risk-based methodologies.
• Coordinate remediation activity across IT and development teams to ensure vulnerabilities are resolved within agreed SLAs.
• Produce clear reports, dashboards, and metrics for technical and senior stakeholders