CSIRT Vulnerability Manager

Company Description

Statkraft has been making clean energy possible for over a century. That is what we offer. 125 years of unrivalled expertise in supplying the world with what it needs most. We envision a world that runs entirely on renewable energy. Because in the fight against climate change, we do not see renewable energy as part of the solution – we believe it must be the solution. With us, you will shape a career that is truly forward-facing with many amazing opportunities and offerings to match.

But there is more work to be done – that is why we need you to join!

Job Description

The Statkraft CSIRT team is part of the Cyber Security Department within Statkraft. Our mission is to avoid or minimize business impact from attempted or conducted cyber-attacks against Statkraft’s digital infrastructure and assets. We act as a central hub of contact, correlation, and coordination of security events based on current threat situation, business risk appetite, and regulatory requirements.

In a constantly evolving digital landscape, staying ahead of emerging threats is critical. As our new Vulnerability Manager, you will play a pivotal role in protecting our digital assets, infrastructure, and applications. You will join a highly skilled cybersecurity team where your primary focus will be to establish governance, drive accountability, and oversee the end-to-end framework that ensures security weaknesses are identified, prioritized, and remediated across the entire organization.

You will own the end-to-end vulnerability management lifecycle across the organization, and your job is to define and refine the practice and standards, enforce Service Level Agreements (SLAs), and empower operational IT and development teams understand the associated risks and prioritize the right corrective actions. Your role is focused on continuously improving and steering the function rather than executing the technical scans. You will be a key driver for improved security governance, a proactive security culture and ensure the continuous improvement of our defenses, which include protecting critical infrastructure in several countries.

Your responsibilities include

• Process Improvement: Advance and mature the organization’s vulnerability management framework, policies, and standard operating procedures.
• Risk Architecture & Prioritization: Establish and revise the frameworks for how vulnerabilities are evaluated and prioritized, combining threat intelligence with business context to determine actual risk.
• Oversight & Accountability: Monitor and enforce vulnerability compliance across Security, Operations, Development, and other relevant departments, acting as the escalation point when SLAs are breached.
• Metrics & Reporting: Design and track Key Performance Indicators (KPIs), risk Indicators, Dashboards etc to deliver clear, data-driven reports for leadership and stakeholders to provide visibility into security posture, trends, and residual risks.
• Cross-Functional Leadership: Lead regular meetings with system owners and business units to align remediation efforts, manage risk acceptances, and resolve resource conflicts.
• Vendor & Tooling Strategy: Oversee the strategic direction of our vulnerability management tooling suite, ensuring vendors and platform capabilities meet the organization's long-term needs.

Qualifications

To be successful in your role, we believe you have:

• A burning interest for cyber security.
• Education: Bachelor’s or Master’s degree in IT, Information Security, Computer Science, or a related field (relevant professional experience may compensate for a lack of formal education).
• Experience: Minimum of 5 years of experience within cyber security, information security, IT operations, or technical vulnerability management.
• Leadership

Skills

• Strong project management capabilities with experience driving initiatives across matrixed, cross-functional technical teams without direct authority.

• Strategic Technical Insight: Solid understanding of vulnerability lifecycles, threat modeling, and how vulnerabilities impact cloud infrastructure (Azure/AWS/GCP) and enterprise networks.

• Tooling Proficiency: Knowledge and experience with industry-standard vulnerability scanners and platforms (e.g., Tenable/Nessus, Qualys, Rapid7, Microsoft Defender Vulnerability Management, or similar).

• Communication & Stakeholder management: Ability to translate complex technical security risks into clear, actionable business terms for both technical and non-technical stakeholders. Fluency in Norwegian and English, both spoken and written. We believe the following skills and experiences would be beneficial:

• Knowledge within the field of AI, especially frontier AI and related consequences for vulnerability management.

• Project management or security certifications such as Prince2, PMP, CISM, CISSP, or platform-specific certifications in cloud security or vulnerability tools.

• Familiarity with cyber security frameworks such as NIST CSF, NIST SP 800-53, ISO 27001, and/or CIS Controls.

• Experience with Application Security (AppSec), DevSecOps, and SAST/DAST tooling.

Additional Information

What we offer

• Unlimited learning opportunities at various levels of the organization
• The chance to grow your career alongside a truly global network of experts, leaders, specialists, and graduates from different countries and backgrounds
• The opportunity to work somewhere with pride, and be able to honestly say “My work is contributing to saving the planet”
• A work culture that puts emphasis on the individual, offering flexible working solutions, and work-life balance principles
• Statkraft offers competitive terms of employment and benefits schemes, and we’re a trusted employer that puts the safety of our people first. We believe that a safe and healthy working environment is a matter of choice, not chance Statkraft manages critical infrastructure and services in several countries. The applicant must be eligible for Norwegian security clearance and authorization.

Statkraft's vision is to renew the way the world is powered. To navigate the complex journey ahead, we need every voice at the table. We therefore work actively to be a diverse and inclusive workplace and welcome all applicants regardless of background, gender, age, sexual orientation, religious belief, ethnicity, nationality or disability.

We evaluate applications for this role on a rolling basis, so please apply with your CV through our career pages as soon as possible, but not later then 14th of November.

Location: The position will require physical presence at the main office in Lilleaker, Oslo, Norway.