InfoSec Vulnerability Remediation Lead (Talent Applications)

About the role

The InfoSec EXP/RP & GVM Remediation Lead drives end-to-end remediation of security vulnerabilities, risk exceptions and compliance findings across Talent applications. The role works with Product Owners, Application Leads, Infrastructure, InfoSec and vendor teams to deliver timely risk mitigation, governance compliance, audit readiness and reduced security risk exposure.

Key responsibilities

• Own and drive remediation of InfoSec findings, GVM vulnerabilities and security risks across Talent applications
• Review, triage, prioritize, assign and track GVM vulnerabilities through resolution
• Coordinate remediation with Application Leads, Product Owners, Infrastructure teams, vendors and InfoSec stakeholders
• Manage the full lifecycle of Security Exceptions (EXP) and Risk Profiles (RP), including submission, review, approval, renewal and closure
• Monitor aging vulnerabilities, exceptions and remediation plans, escalating overdue items and critical risks to leadership
• Maintain remediation trackers, security documentation, audit evidence and compliance records
• Facilitate regular governance reviews and develop dashboards, metrics and executive reporting on GVM, EXP, RP and remediation
• Support security and compliance assessments linked to infrastructure upgrades, application changes and environment refreshes
• Promote continuous improvement to reduce recurring vulnerabilities and ensure adherence to EY security policies, standards, regulatory requirements and audit expectations

Required profile

• Strong understanding of vulnerability management, risk remediation and security governance
• Experience managing GVM findings, remediation plans, security exceptions and risk acceptance processes
• Stakeholder management across Product, Application, Infrastructure, Vendor and Security teams
• Preferred: enterprise security, compliance or risk management experience, familiarity with EY security standards and audit requirements, knowledge of vulnerability management tools and reporting platforms, and experience supporting infrastructure refreshes and application upgrades

Required skills

• Analytical, prioritization and risk management capabilities
• Dashboard, reporting and metrics development
• Strong communication and presentation skills for leadership, audit and governance forums
• Ability to manage multiple remediation initiatives and competing priorities across global teams