We're not hiring someone to run scans. We're hiring someone to build the engine that finds and closes risk before it becomes an incident. We're looking for a Tech Lead who thinks like an attacker prioritizing targets, not an analyst clearing a scan queue. Someone who owns the full vulnerability lifecycle, builds AI-driven prioritization into the pipeline, and turns remediation into a measurable, automated system instead of a spreadsheet of open tickets.
You'll lead Vulnerability Management across cloud, infrastructure, endpoints, and internal environments - turning every scan, exception, and remediation into a shorter exposure window and a more mature program. The goal isn't to keep the vulnerability count low on a dashboard. It's to make exploitable exposure structurally rare.
Why This MattersDeriv's mission is Trading for Anyone, Anywhere, Anytime. Millions of traders across the globe, around the clock, across regulatory environments. At this scale, an unpatched exposure sitting past its SLA isn't a compliance footnote - it's a trader's funds at risk and a regulator on the phone.
Vulnerability Management is a core defensive layer for a platform that never stops processing transactions. When new assets, cloud workloads, and code ship continuously, your discovery and remediation engine can't fall behind - which is exactly why this role exists to turn Vulnerability Management into a fully automated, intelligence-driven function.
The ChallengeMost vulnerability programs are a scan, a spreadsheet, and a monthly report nobody reads until an audit forces the question. That's not this role.
You'll own the vulnerability lifecycle end to end: discovery, enrichment, risk-based prioritization, remediation, validation, and executive reporting, across AWS, GCP, Azure, Kubernetes, containers, endpoints, and network infrastructure. You'll be building automated workflows and AI-assisted prioritization that cut exposure windows quarter over quarter, not chasing CVSS scores in isolation.
If your idea of vulnerability management is exporting a Qualys report and emailing it to engineering, this isn't for you. If you want to architect an automation-first vulnerability engine at global scale and be the technical authority behind it, keep reading.
Why DerivDeriv protects millions of global traders across distributed platforms and cloud environments. Vulnerability Management is a core defensive layer here, not an afterthought bolted onto compliance - and this role is designed to transform it into a measurable, automation-driven, intelligence-led capability with direct impact on enterprise risk reduction.
What You’ll Do
Who You Are
The Honest RealityThis is a hands-on leadership role for someone who builds systems, not just processes. You'll raise findings and SLA breaches that aren't always welcome, and you'll be accountable for exposure windows in a regulated environment where a slipped patch cycle is a real finding, not a rounding error.
But you'll get high ownership and strategic influence within a global fintech security organization, the room to architect automation-first vulnerability management at scale, and direct impact on enterprise risk reduction alongside competitive compensation and a long-term leadership growth path.
If you want to run scans and forward reports, this isn't it. If you want to build the vulnerability engine that makes exploitable exposure the exception instead of the norm, it might be.
