# Senior Exposure Management Analyst

**Company**: Bupa
**Location**: Staines
**Work arrangement**: hybrid
**Experience**: senior
**Job type**: full-time
**Salary**: From £64,000 per annum
**Category**: Security
**Industry**: Healthcare

**Apply**: https://bupa.wd3.myworkdayjobs.com/en-US/EXT_CAREER/job/Staines/Senior-Exposure-Management-Analyst_R1228528?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_13ba2ea5-cfa

## Description

The Senior Exposure Management Analyst is responsible for supporting and enhancing Bupa's Continuous Threat Exposure Management capability, helping identify, assess, prioritise and drive remediation of vulnerabilities and exposures across the technology estate.

**How you'll help us make health happen**

- Operate and continuously improve vulnerability and exposure management processes, including authenticated and unauthenticated scanning, agent deployment, coverage checks, validation of findings, cloud exposure reviews and ongoing service improvement.

- Consolidate and normalise security data into a single pane of glass, supporting exposure management, vulnerability records, assignment groups, remediation tracking, exception management, governance evidence and reporting workflows.

- Assess vulnerabilities and exposures in the context of business risk, using severity, exploitability, threat intelligence, asset criticality, exposure, business impact and regulatory requirements to support risk-based prioritisation.

- Correlate, deduplicate and prioritise findings from vulnerability scanning, penetration testing, breach and attack simulation, Red Team activity, cloud platforms and other exposure data sources to provide one clear position on risk and remediation.

- Drive remediation activity with infrastructure, application, cloud, network and business teams, ensuring risk is clearly explained, ownership is agreed, blockers are challenged and actions are tracked through to closure.

- Provides guidance, coaching and mentoring to analysts and colleagues, helping build capability across vulnerability and exposure management practices.

- Prepare clear updates, dashboards and evidence packs for operational teams, risk forums and leadership, highlighting progress, blockers, ownership, business impact and next steps.

- Plans and manages scanning, remediation tracking and reporting activity to support agreed vulnerability management service levels and risk reduction priorities.

**Key Skills / Qualifications needed for this role:**

- Security+ certification required or strongly preferred; additional certifications such as CISSP, SSCP, GSEC, CySA+, ITIL, cloud security or vendor vulnerability management certifications are beneficial.

- Strong hands-on experience with vulnerability and exposure management tooling, including scan configuration, agent deployment, scan coverage troubleshooting, validation of findings and data quality improvement.

- Practical cloud security and exposure management experience, including understanding cloud assets, misconfigurations, vulnerabilities, ownership and remediation routes.

- Able to interpret CVEs, CVSS, exploitability, threat intelligence, asset criticality and business impact to support risk-based prioritisation.

- Knowledge of penetration testing, breach and attack simulation and Red Team findings, including correlation and deduplication with vulnerability and exposure data.

- Strong stakeholder engagement skills, with experience driving remediation across technical teams and business stakeholders.

- Experience mentoring or supporting colleagues, sharing knowledge and helping improve team capability.

**Benefits**

- 25 days holiday per year, pro rata to your contract.

- Access to a range of services to support your physical and mental wellbeing.

- Fixed term benefits allowance.

- Access to our confidential employee assistance programme.

- Workplace pension.

- Online discounts covering your everyday shopping, entertainment, eating out and more.

## Skills

### Required
- Security+
- vulnerability management
- cloud security
- penetration testing
- breach and attack simulation
- Red Team activity

### Nice to have
- CISSP
- SSCP
- GSEC
- CySA+
- ITIL
- cloud security certifications

---

Source: [Apply at bupa.wd3.myworkdayjobs.com](https://bupa.wd3.myworkdayjobs.com/en-US/EXT_CAREER/job/Staines/Senior-Exposure-Management-Analyst_R1228528?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)