Vulnerability Manager

The Statkraft CSIRT team is part of the Cyber Security Department within Statkraft. Our mission is to avoid or minimize business impact from attempted or conductedcyber-attacks against Statkrafts digital infrastructure and assets. We act as a central hub of contact correlation and coordination of security events based on current threat situation business risk appetite and regulatory requirements. 

In a constantly evolving digital landscape staying ahead of emerging threats is critical. As our new Vulnerability Manager you will play a pivotal role in protecting our digital assets infrastructure and applications. You will join a highly skilled cybersecurity team where your primary focus will be to establish governance drive accountability and oversee the end-to-end framework that ensures security weaknesses are identified prioritized and remediated across the entire organization. 

You will own the end-to-end vulnerability management lifecycle across the organization and your job is to define and refine the practice and standards enforce Service Level Agreements (SLAs) and empower operational IT and development teams understand the associated risks and prioritize the right corrective actions. Your role is focused on continuously improving and steering the function rather than executing the technical scans. You will be a key driver for improved security governance a proactive security culture and ensure the continuous improvement of our defenses which include protecting critical infrastructure in several countries. 

Your responsibilities include

• Process Improvement: Advance and mature the organizations vulnerability management framework policies and standard operating procedures. 
• Risk Architecture & Prioritization: Establish and revise the frameworks for how vulnerabilities are evaluated and prioritized combining threat intelligence with business context to determine actual risk. 
• Oversight & Accountability: Monitor and enforce vulnerability compliance across Security Operations Development and other relevant departments acting as the escalation point when SLAs are breached. 
• Metrics & Reporting: Design and track Key Performance Indicators (KPIs) risk Indicators Dashboards etc to deliver clear data-driven reports for leadership and stakeholders to provide visibility into security posture trends and residual risks.  
• Cross-Functional Leadership: Lead regular meetings with system owners and business units to align remediation efforts manage risk acceptances and resolve resource conflicts. 
• Vendor & Tooling Strategy: Oversee the strategic direction of our vulnerability management tooling suite ensuring vendors and platform capabilities meet the organizations long-term needs.

Qualifications :

To be successful in your role we believe you have: 

• A burning interest for cyber security. 
• Education: Bachelors or Masters degree in IT Information Security Computer Science or a related field (relevant professional experience may compensate for a lack of formal education). 
• Experience: Minimum of 5 years of experience within cyber security information security IT operations or technical vulnerability management. 
• Leadership Skills: Strong project management capabilities with experience driving initiatives across matrixed cross-functional technical teams without direct authority. 
• Strategic Technical Insight: Solid understanding of vulnerability lifecycles threat modeling and how vulnerabilities impact cloud infrastructure (Azure/AWS/GCP) and enterprise networks. 
• Tooling Proficiency: Knowledge and experience with industry-standard vulnerability scanners and platforms (e.g. Tenable/Nessus Qualys Rapid7 Microsoft Defender Vulnerability Management or similar). 
• Communication & Stakeholder management: Ability to translate complex technical security risks into clear actionable business terms for both technical and non-technical stakeholders. Fluency in Norwegian and English both spoken and written. 

We believe the following skills and experiences would be beneficial: 

• Knowledge within the field of AI especially frontier AI and related consequences for vulnerability management. 
• Project management or security certifications such as Prince2 PMP CISM CISSP or platform-specific certifications in cloud security or vulnerability tools. 
• Familiarity with cyber security frameworks such as NIST CSF NIST SP 800-53 ISO 27001 and/or CIS Controls. 
• Experience with Application Security (AppSec) DevSecOps and SAST/DAST tooling. 

Additional Information :

What we offer: 

• Unlimited learning opportunities at various levels of the organization 
• The chance to grow your career alongside a truly global network of experts leaders specialists and graduates from different countries and backgrounds 
• The opportunity to work somewhere with pride and be able to honestly say My work is contributing to saving the planet 
• A work culture that puts emphasis on the individual offering flexible working solutions and work-life balance principles 
• Statkraft offers competitive terms of employment and benefits schemes and were a trusted employer that puts the safety of our people first. We believe that a safe and healthy working environment is a matter of choice not chance 

Statkraft manages critical infrastructure and services in several countries. The applicant must be eligible for Norwegian security clearance and authorization. 
 
Statkrafts vision is to renew the way the world is powered. To navigate the complex journey ahead we need every voice at the table. We therefore work actively to be a diverse and inclusive workplace and welcome all applicants regardless of background gender age sexual orientation religious belief ethnicity nationality or disability. 

We evaluate applications for this role on a rolling basis so please apply with your CV  through our career pages as soon as possible but not later then 14th of November.

Location:The position will require physical presence at the main office in Lilleaker Oslo Norway. 

Remote Work :

No

Employment Type :

Full-time