Senior Vulnerability Management Specialist (Tenable)

We are looking for a senior vulnerability management specialist to run and uplift vulnerability management operations for one of our major clients, a large Australian enterprise based in Sydney. Tenable is the core platform, and you will own it day to day: scan coverage, data quality, prioritisation, remediation tracking and reporting across a large hybrid estate.

This is a hands-on operational role with real accountability. You will be the Tenable subject matter expert on the engagement, and the person infrastructure teams, service owners and security leadership rely on for a clear view of exposure and what to fix first.

What you'll do

• Operate and tune the Tenable platform day to day: scan policies and schedules, credentialed and agent-based scanning, scanner and agent health, asset tagging and access controls
• Own scan coverage and data quality by reconciling Tenable against the CMDB, cloud inventories and endpoint tooling, then closing blind spots and authentication failures
• Triage and prioritise findings on risk (VPR, CVSS, EPSS, known exploited vulnerabilities, asset criticality and internet exposure) rather than raw severity counts
• Drive remediation with infrastructure, cloud, network and application teams: raise and track work through the ITSM tool, agree treatment plans, hold owners to SLAs and verify fixes by rescan
• Lead the response to critical and zero-day vulnerabilities, from rapid exposure assessment and targeted scans through to confirmed closure
• Manage false positives, exceptions and risk acceptances with proper evidence, approval and expiry
• Build dashboards and reporting for operational teams and executives covering coverage, SLA performance, ageing and risk trend, including evidence for Essential Eight and audit requirements
• Automate and integrate using the Tenable API with Python or PowerShell, connecting vulnerability data to ITSM, CMDB, SIEM and patching tools
• Document runbooks and operating procedures, and coach analysts and support teams so the capability outlasts the contract

• ​​​​Strong demonstrable experience in cyber security or infrastructure operations, with at least 4 years hands-on in vulnerability management
• Proven operational experience running Tenable in a large, complex organisation (tens of thousands of assets): Tenable One Vulnerability Management (formerly Tenable.io) and/or Tenable Security Center (formerly Tenable.sc). You have operated the platform day to day, not just consumed its reports
• Deep working knowledge of Nessus scanners and agents, credentialed scanning, scan policy tuning, asset tagging, VPR, dashboards, and recast and accept rules
• Exposure to the wider Tenable One platform, such as web application scanning, cloud, identity or attack surface management
• A track record of driving remediation at scale across multiple technology teams, with measurable reduction in ageing and critical exposure