Vulnerability Operations Center Lead

About the role

We are seeking a senior leader to establish and run a Vulnerability Operations Center for a fast‑growing technology organization focused on AI infrastructure. Based in France, you will shape the end‑to‑end vulnerability management lifecycle across large‑scale cloud, infrastructure and hardware environments.

Key responsibilities

• Build and lead the Vulnerability Operations Center, defining processes, governance and best practices.
• Manage detection, validation, triage, remediation tracking and reporting for cloud, product and hardware assets.
• Enhance automated triage with data enrichment, AI‑assisted workflows, contextual risk scoring and vulnerability correlation.
• Perform hands‑on validation and prioritisation of critical and zero‑day findings.
• Collaborate with engineering, security, compliance and operations teams to drive timely remediation.
• Improve patch‑management processes and oversee remediation across multiple engineering groups.
• Handle vulnerability intake from scanners, penetration tests, bug‑bounty programs and threat‑intelligence feeds.
• Prioritise findings using CVSS, EPSS, SSVC, exploitability, asset criticality and business impact.
• Develop and automate internal vulnerability management and security orchestration platforms.
• Define metrics, monitor trends and present actionable KPIs to security leadership.

Required profile

• 5‑8 years of information‑security experience, with at least 3 years focused on vulnerability management or security operations.
• Proven ability to design and run a security operations function at scale.
• Strong communication and cross‑functional collaboration skills.

Required skills

• Vulnerability management processes and frameworks (CVE, NVD, CVSS, EPSS, SSVC).
• Cloud platforms: AWS, Google Cloud, Microsoft Azure.
• Automation and AI‑assisted workflow design.
• Security orchestration, automation and response (SOAR) platforms.
• Patch‑management and remediation coordination.
• Experience with vulnerability scanners, penetration testing and bug‑bounty programs.
• Threat‑intelligence integration and risk‑scoring techniques.