Vulnerability Manager

The Statkraft CSIRT team is part of the Cyber Security Department within Statkraft. Our mission is to avoid or minimize business impact from attempted or conducted cyber-attacks against Statkraft’s digital infrastructure and assets. We act as a central hub of contact, correlation, and coordination of security events based on current threat situation, business risk appetite, and regulatory requirements.
In a constantly evolving digital landscape, staying ahead of emerging threats is critical. As our new Vulnerability Manager, you will play a pivotal role in protecting our digital assets, infrastructure, and applications. You will join a highly skilled cybersecurity team where your primary focus will be to establish governance, drive accountability, and oversee the end-to-end framework that ensures security weaknesses are identified, prioritized, and remediated across the entire organization.
You will own the end-to-end vulnerability management lifecycle across the organization, and your job is to define and refine the practice and standards, enforce Service Level Agreements (SLAs), and empower operational IT and development teams understand the associated risks and prioritize the right corrective actions. Your role is focused on continuously improving and steering the function rather than executing the technical scans. You will be a key driver for improved security governance, a proactive security culture and ensure the continuous improvement of our defenses, which include protecting critical infrastructure in several countries.
Your responsibilities include
Process Improvement: Advance and mature the organization’s vulnerability management framework, policies, and standard operating procedures.
Risk Architecture & Prioritization: Establish and revise the frameworks for how vulnerabilities are evaluated and prioritized, combining threat intelligence with business context to determine actual risk.
Oversight & Accountability: Monitor and enforce vulnerability compliance across Security, Operations, Development, and other relevant departments, acting as the escalation point when SLAs are breached.
Metrics & Reporting: Design and track Key Performance Indicators (KPIs), risk Indicators, Dashboards etc to deliver clear, data-driven reports for leadership and stakeholders to provide visibility into security posture, trends, and residual risks.
Cross-Functional Leadership: Lead regular meetings with system owners and business units to align remediation efforts, manage risk acceptances, and resolve resource conflicts.
Vendor & Tooling Strategy: Oversee the strategic direction of our vulnerability management tooling suite, ensuring vendors and platform capabilities meet the organization's long-term needs.
To be successful in your role, we believe you have:
A burning interest for cyber security.
Education: Bachelor’s or Master’s degree in IT, Information Security, Computer Science, or a related field (relevant professional experience may compensate for a lack of formal education).
Experience: Minimum of 5 years of experience within cyber security, information security, IT operations, or technical vulnerability management.
Leadership Skills: Strong project management capabilities with experience driving initiatives across matrixed, cross-functional technical teams without direct authority.
Strategic Technical Insight: Solid understanding of vulnerability lifecycles, threat modeling, and how vulnerabilities impact cloud infrastructure (Azure/AWS/GCP) and enterprise networks.
Tooling Proficiency: Knowledge and experience with industry-standard vulnerability scanners and platforms (e.g., Tenable/Nessus, Qualys, Rapid7, Microsoft Defender Vulnerability Management, or similar).
Communication & Stakeholder management: Ability to translate complex technical security risks into clear, actionable business terms for both technical and non-technical stakeholders. Fluency in Norwegian and English, both spoken and written.
We believe the following skills and experiences would be beneficial:
Knowledge within the field of AI, especially frontier AI and related consequences for vulnerability management.
Project management or security certifications such as Prince2, PMP, CISM, CISSP, or platform-specific certifications in cloud security or vulnerability tools.
Familiarity with cyber security frameworks such as NIST CSF, NIST SP 800-53, ISO 27001, and/or CIS Controls.
Experience with Application Security (AppSec), DevSecOps, and SAST/DAST tooling.

Employment type
Full-time

Work arrangement
Hybrid