Senior Vulnerability Management Engineer

About the role

LSEG is looking for a Senior Vulnerability Management Engineer to join its internal offensive security team, focusing on closing penetration testing findings. The role bridges offensive security and engineering by turning penetration test results into clear, actionable remediation guidance and partnering with application and platform teams to implement secure fixes. It is a highly technical, delivery-focused position covering both individual findings and systemic improvements.

Key responsibilities

• Analyse and review penetration test reports to understand technical impact, exploitability and business risk.
• Develop, document and maintain remediation guidance, patterns and blueprints for common vulnerability types (injections, access control, authentication, session management, misconfigurations).
• Advise application and platform teams on secure design and remediation, including code, configuration and business-level recommendations.
• Coordinate remediation across teams, with clear ownership, agreed timelines and risk-based prioritisation.
• Validate fixes by retesting manually and/or with tools and scripts, and update finding statuses to closure.
• Manage and track the remediation backlog, including SLAs, aging findings and critical issues.
• Maintain documentation on remediation processes, workflows and controls for audit and compliance, and report progress and risk reduction to management and partners.
• Run root cause analysis on recurring issues and work with engineering, architecture and governance teams on long-term fixes.
• Improve the pentest-to-remediation lifecycle, including automation, standardisation and integration with SDLC/DevSecOps pipelines.
• Contribute to team improvement, knowledge sharing and mentoring, and take part in R&D initiatives and stay ahead of emerging threats.

Required profile

• Proven hands-on penetration testing experience of web applications, APIs, thick clients and common infrastructures (Active Directory, cloud and cloud-native environments).
• Experience automating pentesting tasks and in large, complex enterprise environments.
• Track record of managing and driving security engagements for organisations with different profiles, and of communicating technical and project risks clearly.
• English proficiency, written and spoken; relevant certifications and threat modelling experience are a plus.

Required skills

• Burp Suite and command-line tools, with custom scripting when needed.
• Cloud platforms (AWS, Azure, GCP) and containerised environments (Docker, Kubernetes).
• OWASP Top 10, SANS Top 25 and secure coding in at least one major stack (Java/Spring Boot.NET, JavaScript/Node, Python).