Vulnerability Manager

About the Position

We are seeking a Vulnerability Manager to join Statkraft's CSIRT team, part of the Cyber Security Department. Our mission is to protect Statkraft’s digital infrastructure and assets from cyber threats. As the Vulnerability Manager, you will play a pivotal role in establishing governance, driving accountability, and overseeing the end-to-end framework that ensures security weaknesses are identified, prioritized, and remediated across the entire organization.

Responsibilities

• Process Improvement: Advance and mature the organization’s vulnerability management framework, policies, and standard operating procedures.
• Risk Architecture & Prioritization: Establish and revise the frameworks for how vulnerabilities are evaluated and prioritized, combining threat intelligence with business context to determine actual risk.
• Oversight & Accountability: Monitor and enforce vulnerability compliance across Security, Operations, Development, and other relevant departments, acting as the escalation point when SLAs are breached.
• Metrics & Reporting: Design and track Key Performance Indicators (KPIs), risk indicators, dashboards, etc. to deliver clear, data-driven reports for leadership and stakeholders to provide visibility into security posture, trends, and residual risks.
• Cross-Functional Leadership: Lead regular meetings with system owners and business units to align remediation efforts, manage risk acceptances, and resolve resource conflicts.
• Vendor & Tooling Strategy: Oversee the strategic direction of our vulnerability management tooling suite, ensuring vendors and platform capabilities meet the organization's long-term needs.

Requirements

• A burning interest for cyber security.
• Education: Bachelor’s or Master’s degree in IT, Information Security, Computer Science, or a related field (relevant professional experience may compensate for a lack of formal education).
• Experience: Minimum of 5 years of experience within cyber security, information security, IT operations, or technical vulnerability management.
• Leadership Skills: Strong project management capabilities with experience driving initiatives across matrixed, cross-functional technical teams without direct authority.
• Strategic Technical Insight: Solid understanding of vulnerability lifecycles, threat modeling, and how vulnerabilities impact cloud infrastructure (Azure/AWS/GCP) and enterprise networks.
• Tooling Proficiency: Knowledge and experience with industry-standard vulnerability scanners and platforms (e.g., Tenable/Nessus, Qualys, Rapid7, Microsoft Defender Vulnerability Management, or similar).
• Communication & Stakeholder management: Ability to translate complex technical security risks into clear, actionable business terms for both technical and non-technical stakeholders. Fluency in Norwegian and English, both spoken and written.

Nice to Have

• Knowledge within the field of AI, especially frontier AI and related consequences for vulnerability management.
• Project management or security certifications such as Prince2, PMP, CISM, CISSP, or platform-specific certifications in cloud security or vulnerability tools.
• Familiarity with cyber security frameworks such as NIST CSF, NIST SP 800-53, ISO 27001, and/or CIS Controls.
• Experience with Application Security (AppSec), DevSecOps, and SAST/DAST tooling.

We Offer

• Unlimited learning opportunities at various levels of the organization.
• The chance to grow your career alongside a truly global network of experts, leaders, specialists, and graduates from different countries and backgrounds.
• The opportunity to work somewhere with pride, and be able to honestly say “My work is contributing to saving the planet”.
• A work culture that puts emphasis on the individual, offering flexible working solutions, and work-life balance principles.
• Statkraft offers competitive terms of employment and benefits schemes, and we’re a trusted employer that puts the safety of our people first. We believe that a safe and healthy working environment is a matter of choice, not chance.

About the Company

Statkraft has been making clean energy possible for over a century. That is what we offer. 125 years of unrivalled expertise in supplying the world with what it needs most. We envision a world that runs entirely on renewable energy. Because in the fight against climate change, we do not see renewable energy as part of the solution – we believe it must be the solution. With us, you will shape a career that is truly forward-facing with many amazing opportunities and offerings to match.

But there is more work to be done – that is why we need you to join!

Statkraft manages critical infrastructure and services in several countries. The applicant must be eligible for Norwegian security clearance and authorization.

Statkraft's vision is to renew the way the world is powered. To navigate the complex journey ahead, we need every voice at the table. We therefore work actively to be a diverse and inclusive workplace and welcome all applicants regardless of background, gender, age, sexual orientation, religious belief, ethnicity, nationality, or disability.

We evaluate applications for this role on a rolling basis, so please apply with your CV through our career pages as soon as possible, but not later than 6th of November.

Job Location

Location: The position will require physical presence at the main office in Lilleaker, Oslo, Norway.