Project Manager - Talent Operate / InfoSec (GVM Remediation Lead)

About the role

EY Global Delivery Services is looking for a Project Manager for its Talent Operate / InfoSec function, acting as InfoSec EXP/RP and GVM Remediation Lead. The role drives end-to-end remediation of security vulnerabilities, risk exceptions and compliance findings across Talent applications, partnering with Product Owners, Application Leads, Infrastructure, InfoSec and vendor teams to ensure timely risk mitigation, governance compliance, audit readiness and reduced security risk exposure.

Key responsibilities

• Own and drive remediation of InfoSec findings, GVM vulnerabilities and security risks across Talent applications
• Review, triage, prioritize, assign and track GVM vulnerabilities through resolution
• Coordinate remediation with Application Leads, Product Owners, Infrastructure teams, vendors and InfoSec stakeholders
• Manage the full lifecycle of Security Exceptions (EXP) and Risk Profiles (RP), including submission, review, approval, renewal and closure
• Monitor aging vulnerabilities, exceptions and remediation plans, escalating overdue items and critical risks to leadership
• Maintain remediation trackers, security documentation, audit evidence and compliance records
• Facilitate regular governance reviews and develop dashboards, metrics and executive reporting on GVM, EXP, RP and remediation
• Support security and compliance assessments linked to infrastructure upgrades, application changes and environment refreshes
• Drive continuous improvement to reduce recurring vulnerabilities and strengthen the Talent security posture

Required profile

• Strong understanding of vulnerability management, risk remediation and security governance
• Experience managing GVM findings, remediation plans, security exceptions and risk acceptance processes
• Stakeholder management across Product, Application, Infrastructure, Vendor and Security teams
• Preferred: experience in enterprise security, compliance or risk management programs, familiarity with EY security standards and audit requirements, knowledge of vulnerability management tools and reporting platforms, and experience supporting infrastructure refreshes and application upgrades

Required skills

• Analytical, prioritization and risk management capabilities
• Dashboard, reporting and metrics development
• Communication and presentation skills for leadership, audit and governance forums
• Ability to manage multiple remediation initiatives across global teams

Success is measured by reduced overdue GVM vulnerabilities and EXP/RP items, achieved remediation SLAs and compliance targets, timely closure of security exceptions, accurate reporting and audit readiness, and improved visibility of security risks.