EY is seeking an experienced and authoritative Patching and Vulnerability Compliance Lead to enhance our I&O Platform Infrastructure capabilities. This senior leadership role is crucial for driving patching compliance, vulnerability management, and security posture reporting across EY's global infrastructure estate. The position is integral to the Infrastructure Operations Centre (IOC), acting as the firm's primary authority on infrastructure security and compliance.

Lead the end-to-end patching governance framework, ensuring vulnerability remediation commitments are met and compliance is accurately reported. Manage exceptions through a rigorous, risk-based process. Drive weekly, monthly, and quarterly compliance reporting, chair cross-tower patching forums, and manage escalations from security and audit stakeholders. Lead the firm's response to frontier AI-related infrastructure risks, assessing and remediating emerging threats. Partner with engineering leads, security operations, risk, and compliance teams to maintain a secure and compliant global infrastructure.

A minimum of 7 years of experience in cross-platform patching governance and vulnerability management is required. Expertise in Windows Server patching (WSUS, MECM, MDE) and Linux patching (Satellite, Ansible, YUM/APT) is essential. Proficiency with vulnerability scanning tools (Qualys, Tenable, Rapid7) and CVSS scoring is necessary. Experience in leading patching forums, managing exceptions, and producing executive-level compliance reporting is vital. Strong scripting skills in PowerShell or Python for automation are also required. Familiarity with ITIL, CIS, NIST, ISO 27001, and SOC 2 frameworks is expected. Experience in an IOC or equivalent 24x7 operations environment is beneficial.