Job Summary:
The Ops SME/SMR for Global Vulnerability Management (GVM), is responsible for leading the organization's vulnerability management program, ensuring effective assessment, prioritization, remediation of security vulnerabilities across on-premises, cloud, application, database, and network environments. The role provides strategic oversight, governance, stakeholder management, and executive reporting to continuously strengthen the organization's cybersecurity posture and reduce technology risk.

Essential Functions of the Job:

Together with the AMS Lead:
   Define vulnerability management strategy, policies, standards, and procedures aligned with organizational risk appetite
   Lead and coordinate end-to-end vulnerability management activities across enterprise systems.
    Establish governance frameworks, remediation SLAs, and performance metrics
   Partner with infrastructure, cloud, application development, operations, and security teams to ensure timely vulnerability remediation
   Prioritize vulnerabilities based on risk, severity, exploitability, and business impact
   Monitor remediation progress and ensure adherence to established SLA requirements
   Present vulnerability risk posture and remediation progress to senior leadership and governance committees
   Support internal and external audits by providing evidence related to vulnerability management controls
   Ensure compliance with cybersecurity policies, security standards, and regulatory requirements
   Coordinate exception management processes and document risk acceptance decisions
   Act as an escalation point for critical and high-risk vulnerabilities
   Required 24/7 on-call support (e.g. escalations, vacation, holiday, weekend coverage) 
   Working in a corporate IT environment with multiple disciplines to deliver projects in line with customer needs
   Working in a corporate IT environment in the Operational / Support Service Management role meeting ITIL framework 

Analytical/Decision Making Responsibilities:
   Ability to prioritize tasks based on criticality.
   Must be able to work within a matrix organization balancing the needs of the service line against firm initiatives and goals
   Must make decisions, such as prioritize relationships to develop, negotiate with customers and overcome obstacles
   Analyse trends to identify automation and optimization opportunities.
   Identify, manage and resolve complex issues, preventing escalations, where possible 
   Manage, negotiate and resolve project risks effectively
   Demonstrate, by example, in-depth knowledge of the EY competency principles and practices, including coaching, learning and mentoring
   Leader and team player
   Create an open, honest, accountable and collaborative team environment

Knowledge and Skills Requirements:
   Strong understanding of Vulnerability Management and Cybersecurity principles
   High level understanding of service line business processes and application landscape.
   Understanding of CVSS scoring, Common Vulnerabilities and Exposures (CVE), and risk assessment methodologies
   Experience working with .Net Applications, Microsoft Azure, SQL/Oracle Databases
   Knowledge on network security, cloud platforms, and application security
   Relationship management (internal & external stakeholders)
   End to end understanding of IT life cycle (pipeline, resource, demand, project delivery, financial)
   7+ years of application services and/or client/supplier relationship management in a technology environment
   Good business acumen and ability to negotiate with business partners
   Customer centric mindset and able to manage customer expectations
   Good executive presence
   Ability to develop strategic plans and translate them to actionable roadmaps
   Initiates, builds and maintains productive customer relationships
   Flexibility to adjust to multiple demands, shifting priorities, ambiguity and rapid change
   Knowledge of IT Infrastructure Azure, Windows, SQL Server. 
   Basic project management skills. Demonstrates strong understanding of scope, schedule and planning, time management, resource management and cost management.

Supervision Responsibilities:
   No direct reports
   Establish AMS governance processes, SOPs, and compliance guidelines.
   Working relationships (daily) with EY ITSD and AMS Lead
   Working relationships (daily) with TCS AMS team and Infosec Team
   ET Liaison

Other Requirements:
   Travel may be required (minimal)
   Fluent English speaker
   Excellent communication skills in English

Job Requirements:
Education:

   A degree in Computer Science and/or a business-related degree; or equivalent work experience

Experience:
   10+ years in a corporate IT environment 
   Minimum 5+ years in a corporate IT environment working in the Operational / Support Service Management role meeting ITIL framework.
   Minimum 5+ years in corporate IT environment working in security compliance and vulnerability remediation for Infra including Web/App Servers, DB Servers, Cloud.
   ServiceNow experience for ITIL
   Work experience in a professional services industry, preferred

Certification Requirements:
   Certifications in the following industry practices would be a plus (ITIL, BPM, etc)
   SAP SuccessFactors RCM/RMK/Onboarding Certification