Secure by Design Manager

📍 Job Overview

Job Title: Secure by Design Manager

Company: Vodafone

Location: Lisbon, Portugal

Job Type: Full-Time

Category: Cybersecurity Operations / GTM Security Integration

Date Posted: 2026-09-28

Experience Level: 3-5 Years

Remote Status: Hybrid

🚀 Role Summary

• Lead the integration of security principles into the design and development lifecycle for Vodafone's global products, services, and infrastructure, ensuring "Secure by Design" is a foundational element.

• Conduct technical security assessments and provide expert guidance to internal teams and external partners throughout the M&A due diligence process, identifying and mitigating compliance and risk factors.

• Act as a key interface between technical cybersecurity disciplines and business stakeholders, translating complex security requirements into actionable guidance for solution architects, developers, and agile project teams.

• Drive the adoption of DevSecOps practices and agile security coaching to embed security proactively within development pipelines and new product/service introductions.

• Develop and implement robust security requirements for new and existing offerings, ensuring adherence to Vodafone's security standards and the confidentiality, integrity, and availability of systems and data.

📝 Enhancement Note: This role focuses on proactive security integration within the GTM (Go-To-Market) and product development lifecycle, rather than reactive incident response. It requires a strong blend of technical security expertise, strategic advisory capabilities, and cross-functional collaboration skills to influence product roadmaps and M&A strategies. The "Manager" title suggests leadership potential and responsibility for guiding security initiatives.

📈 Primary Responsibilities

• Execute technically oriented security assessments for new products, services, and infrastructure changes requested by VF Partners, defining security requirements and evaluating compliance and risk.

• Participate actively in technical due diligence for Mergers and Acquisitions (M&A) processes, assessing cyber-related compliance and risks prior to transaction closure.

• Provide expert security design and architecture guidance to solution architects, designers, developers, and agile project teams, acting as a cyber coach.

• Oversee and coordinate security penetration testing activities for products and services prior to their launch, ensuring identified vulnerabilities are addressed.

• Serve as a subject matter expert in Cybersecurity, collaborating closely with Risk & Compliance, Ethical Hacking, Security Operations, and Corporate Security teams to ensure a holistic security posture.

• Define, communicate, and enforce Vodafone's security standards with suppliers and third-party partners, ensuring their compliance throughout the supply chain.

• Champion the "Security by Design" and "Privacy by Design" principles, influencing the perception of security as a business enabler and differentiator rather than an impediment.

• Facilitate effective communication of complex security requirements and risks to all levels of the business, including non-technical executives, providing clear guidance on implementing security controls.

• Proactively identify and disseminate best practices for securing APIs and other critical components across the organization.

📝 Enhancement Note: The primary responsibilities highlight a strategic, advisory, and governance-focused role. The emphasis on M&A due diligence, partner engagement, and influencing development lifecycles points to a critical GTM enabler function where security is a key competitive advantage.

🎓 Skills & Qualifications

Education:

• University degree in Information Security, Computer Science, or a related technical field, or equivalent practical experience. Experience:

• 3-5 years of progressive work experience in the field of cybersecurity.

• Professional experience in information technology, with a strong focus on cybersecurity principles and practices.

• Proven experience working with security in agile methodologies and DevSecOps environments. Required Skills:

• Deep understanding of "Security by Design" and "Privacy by Design" principles and their practical application.

• Expertise in conducting technical security assessments and defining security requirements.

• Experience with M&A technical due diligence processes from a cybersecurity perspective.

• Strong knowledge of security architecture frameworks (e.g., TOGAF, SABSA) and security best practices.

• Proficiency in communicating complex technical security concepts to both technical and non-technical audiences, including executive leadership.

• Experience acting as a cyber coach or security advisor to agile project and program teams.

• Familiarity with security controls for cloud environments (AWS, Azure, GCP), web services, CI/CD pipelines, and container technologies.

• Knowledge of user access management, network security principles, and penetration testing methodologies.

• Fluency in English, both written and spoken. Preferred Skills:

• Professional certifications such as CISSP, CISM, CISA, CRISC, ISO 27001 Lead Auditor, GIAC, TOGAF, or SABSA.

• Hands-on experience with securing specific cloud platforms, web services, and CI/CD tools.

• Experience with security vulnerability management and remediation strategies.

• Familiarity with data privacy regulations (e.g., GDPR) and their impact on security design.

• Experience in managing external resources or third-party security engagements.

📝 Enhancement Note: The required certifications (CISSP, CISM, etc.) are standard for mid-to-senior level cybersecurity roles, indicating a need for proven expertise. The emphasis on agile, DevSecOps, and cloud security reflects current industry demands for modern technology stacks.

📊 Process & Systems Portfolio Requirements

Portfolio Essentials:

• Demonstrate experience in developing and implementing security requirements for new products and services, showcasing a "Secure by Design" approach.

• Provide case studies or examples of technical security assessments conducted, highlighting methodologies used, risks identified, and recommended mitigation strategies.

• Showcase experience in evaluating and integrating security into M&A due diligence processes, detailing risk assessment and compliance evaluation.

• Illustrate experience in defining security architectures and providing guidance to development teams, with examples of how security was embedded into the solution design.

• Present examples of how you have coached agile teams or influenced development lifecycles to incorporate security best practices (e.g., DevSecOps). Process Documentation:

• Documented examples of security requirement definition processes for new product launches.

• Templates or frameworks used for technical security assessments and risk evaluations.

• Case studies detailing the integration of security into agile development workflows or CI/CD pipelines.

• Examples of security policies or standards communicated to and enforced with external partners and suppliers.

📝 Enhancement Note: For a role focused on "Secure by Design" and M&A, a portfolio should emphasize proactive security integration, risk management in complex transactions, and effective stakeholder influence. Demonstrating a structured approach to defining and embedding security requirements is crucial.

💵 Compensation & Benefits

Salary Range:

• Based on industry benchmarks for a Secure by Design Manager with 3-5 years of experience in Lisbon, Portugal, the estimated annual salary range is €55,000 - €75,000. This estimate accounts for the specialized nature of cybersecurity, the hybrid work model, and the cost of living in Lisbon. Benefits:

• Hybrid Work Model: Flexible hybrid work arrangement with 8-10 in-office days per month, fostering work-life balance.

• Vodafone Products & Services: Employees receive a company mobile phone, a free communication plan, a data card, and various discounts on Vodafone services and products.

• Recognition Programs: Opportunities for recognition for innovative, creative, high-potential contributions, and exemplary behaviors.

• Health and Well-being: Comprehensive Well-being Program including nutrition and psychological consultations, webinars, workshops, and discounts on wellness-related services and products.

• Learning and Development: Access to a robust digital training platform with high-quality content from providers like Harvard Business Publishing, Skillsoft, and Speexx, alongside Communities of Practice.

• Local and International Mobility: Opportunities for internal career progression through local and international rotation across departments and roles.

Working Hours:

• Standard full-time working hours, typically around 40 hours per week, with flexibility offered through the hybrid work model.

📝 Enhancement Note: Salary estimation is based on general market data for cybersecurity roles in Portugal and the specified experience level. Benefits are detailed as provided in the source data, highlighting Vodafone's commitment to employee well-being and development.

🎯 Team & Company Context

🏢 Company Culture

Industry: Telecommunications and Technology. Vodafone is a global leader in connectivity, providing mobile and fixed broadband services, and is actively involved in digital transformation initiatives, IoT, and enterprise solutions.

Company Size: Large Enterprise (over 10,000 employees globally). This size implies a structured environment with established processes, extensive resources, and opportunities for global collaboration.

Founded: 1991. With a long history in the telecommunications sector, Vodafone has evolved significantly, adapting to technological advancements and market shifts.

Team Structure:

• The Secure by Design Manager operates within the Global Cyber VF Investments / M&A Team, indicating a specialized focus on M&A activities and strategic security integration.

• This team likely works closely with Solution Architects, Design teams, Development teams, and other security functions such as Risk & Compliance, Ethical Hacking, Security Operations, and Corporate Security.

• The role involves collaboration across various business units and technical disciplines, requiring strong stakeholder management and cross-functional alignment. Methodology:

• Emphasis on "Security and Privacy by Design" principles, embedding security considerations from the earliest stages of product and service development.

• Application of agile methodologies and DevSecOps practices to streamline security integration within fast-paced development cycles.

• Data-driven risk assessment and compliance evaluation, particularly crucial during M&A due diligence.

• Collaborative approach to problem-solving, involving diverse teams to ensure comprehensive security solutions.

Company Website: https://www.vodafone.com/

📝 Enhancement Note: The company's focus on connectivity and digital transformation suggests that security is a critical enabler for their business strategy, especially in M&A and new service offerings. The team structure points to a matrixed environment requiring strong influencing skills.

📈 Career & Growth Analysis

Operations Career Level: This role sits at a mid-to-senior level within the cybersecurity domain, specifically focused on proactive security integration rather than direct operations management. It requires specialized expertise and the ability to influence strategic decisions.

Reporting Structure: The Secure by Design Manager reports into the Global Cyber VF Investments / M&A Team, suggesting a reporting line that bridges specialized cybersecurity functions with strategic investment and acquisition activities. This position likely reports to a senior manager or director within the cybersecurity or M&A integration group.

Operations Impact: The role has a significant impact on Vodafone's business by ensuring that new products, services, and acquired entities are secure from inception. This reduces future security risks, enhances customer trust, protects brand reputation, and ensures compliance, thereby safeguarding revenue and enabling growth through secure, innovative offerings.

Growth Opportunities:

• Specialization Advancement: Deepen expertise in specific areas like cloud security architecture, DevSecOps, or M&A security integration, potentially leading to Principal or Lead Architect roles.

• Leadership Development: Transition into managing larger teams or broader security domains within the cybersecurity function, potentially moving into roles like Head of Security Architecture or Director of Cyber Investments.

• Cross-Functional Leadership: Leverage experience in M&A and product security to move into strategic roles within product management, enterprise architecture, or risk management, focusing on the intersection of business strategy and technology security.

• Global Exposure: Utilize the international mobility opportunities to gain experience in different markets and regulatory environments, broadening professional perspective and career options.

📝 Enhancement Note: The role offers a clear path for specialization within cybersecurity and potential for leadership growth, particularly in areas critical to Vodafone's strategic objectives like M&A and new product development. The emphasis on influencing and advisory capacity positions candidates for broader strategic roles.

🌐 Work Environment

Office Type: Hybrid Work Model. The role is based in Lisbon, Portugal, with a hybrid arrangement requiring 8-10 days per month in the office. This indicates a balance between remote flexibility and in-person collaboration.

Office Location(s): Lisbon, Portugal. Specific office details would typically be provided upon further engagement, but the location offers access to a vibrant tech and business hub.

Workspace Context:

• Collaborative Environment: The hybrid model and the nature of the role necessitate strong collaboration with various teams (architecture, development, business, M&A) both in-person and remotely.

• Technology & Tools: Access to standard enterprise IT infrastructure, cybersecurity tools, collaboration platforms, and potentially specialized security assessment and modeling software.

• Team Interaction: Regular interaction with colleagues within the Global Cyber VF Investments / M&A Team, as well as with cross-functional teams, fostering knowledge sharing and collective problem-solving.

Work Schedule:

• Standard full-time hours (approx. 40 hours/week) are expected. The hybrid model provides flexibility in how and where these hours are worked, with specific in-office days coordinated with team leaders.

📝 Enhancement Note: The hybrid model is a key aspect of the work environment, balancing flexibility with the need for in-person collaboration, which is vital for security architecture and M&A due diligence.

📄 Application & Portfolio Review Process

Interview Process:

• Initial Screening: HR or recruiter call to assess basic qualifications, interest, and cultural fit.

• Hiring Manager Interview: In-depth discussion about your experience in cybersecurity, "Secure by Design" principles, M&A due diligence, and leadership style. Expect questions on how you've applied these concepts.

• Technical/Panel Interview: This will likely involve a panel of cybersecurity experts, solution architects, or business stakeholders. You may be asked to discuss case studies, solve hypothetical security challenges, or present a portion of your portfolio.

• Case Study/Presentation: Candidates may be asked to prepare and present a case study on a past project demonstrating their ability to implement security by design, conduct a security assessment, or advise on M&A security.

• Final Interview: Potentially with a senior leader to discuss strategic alignment, long-term vision, and final confirmation.

Portfolio Review Tips:

• "Secure by Design" Focus: Highlight projects where you successfully embedded security early in the development lifecycle. Quantify the impact (e.g., reduced vulnerabilities, faster time-to-market due to proactive security).

• M&A Due Diligence: Showcase your ability to assess complex technical environments, identify critical security risks, and provide actionable recommendations under tight deadlines. Use anonymized examples.

• Architecture & Guidance: Present examples of security architecture diagrams, security requirement documents, or how you've guided development teams to implement secure solutions.

• Process Improvement: Detail any processes you've improved or implemented for security assessments, testing coordination, or DevSecOps integration.

• Quantifiable Results: Whenever possible, use metrics to demonstrate the value of your contributions (e.g., percentage reduction in critical vulnerabilities, successful security audits, compliance adherence).

Challenge Preparation:

• Scenario-Based Questions: Be prepared for questions like: "How would you approach securing a new cloud-native application?" or "What are the key security considerations for acquiring a company with significant intellectual property?"

• Risk Prioritization: Practice articulating how you would prioritize security risks in a fast-paced M&A environment with limited information.

• Stakeholder Communication: Prepare examples of how you've communicated complex security issues to non-technical executives and successfully influenced their decisions.

• DevSecOps Principles: Be ready to discuss how to integrate security controls and testing into CI/CD pipelines and agile workflows.

📝 Enhancement Note: The interview process will likely assess both technical depth and strategic influence. A well-curated portfolio that clearly demonstrates experience in "Secure by Design" and M&A security is essential for this role.

🛠 Tools & Technology Stack

Primary Tools:

• Security Assessment Tools: Familiarity with vulnerability scanners (e.g., Nessus, Qualys), penetration testing tools (e.g., Metasploit, Burp Suite), and application security testing (SAST/DAST) platforms.

• Architecture & Design Tools: Experience with diagramming tools (e.g., Visio, Lucidchart) for creating security architecture diagrams, and potentially frameworks like TOGAF or SABSA modeling tools.

• Collaboration & Project Management: Proficiency in tools like Jira, Confluence, Microsoft Teams, Slack for agile project management, documentation, and communication.

• Threat Modeling Tools: Familiarity with tools or methodologies for threat modeling (e.g., STRIDE, PASTA).

Analytics & Reporting:

• Security Information and Event Management (SIEM) Systems: Understanding of how security event data is collected and analyzed for risk assessment (though direct SIEM operation might be with SOC teams).

• Reporting & Dashboarding Tools: Experience using tools like Tableau, Power BI, or internal Vodafone reporting systems to present security assessment findings, risks, and compliance status to stakeholders.

CRM & Automation:

• CRM Systems (for partner/supplier engagement): While not a direct CRM role, understanding how to interface with sales or partner management regarding security requirements may involve interaction with CRM data.

• Workflow Automation: Experience with tools or scripting for automating security tasks or integrating security checks into CI/CD pipelines (e.g., Jenkins, GitLab CI, scripting languages like Python).

• Cloud Platforms: Deep understanding of security controls and best practices within major cloud providers (AWS, Azure, GCP).

📝 Enhancement Note: Proficiency with cloud security, DevSecOps tooling, and standard cybersecurity assessment and collaboration platforms is expected. The role requires translating technical tool capabilities into strategic security outcomes.

👥 Team Culture & Values

Operations Values:

• Security First: A core commitment to embedding security into every aspect of product and service design and development.

• Collaboration & Partnership: Proactive engagement with business, technology, and M&A teams to achieve shared security objectives.

• Innovation & Proactivity: Encouraging new approaches to security and anticipating future threats and vulnerabilities.

• Accountability & Ownership: Taking responsibility for the security posture of products and services throughout their lifecycle.

• Continuous Improvement: A drive to refine processes, learn new technologies, and adapt to evolving security landscapes.

Collaboration Style:

• Cross-Functional Integration: Actively works with diverse teams, acting as a bridge between technical security experts and business decision-makers.

• Advisory & Coaching: Provides guidance and mentorship, fostering a security-aware culture across the organization, particularly within agile teams.

• Influence & Negotiation: Leverages expertise and data to influence stakeholders and negotiate security requirements, ensuring alignment with business goals.

• Knowledge Sharing: Engages in sharing best practices and insights through internal communities and team interactions.

📝 Enhancement Note: Vodafone's emphasis on "Belonging" suggests a culture that values diversity and inclusion. For this role, the values translate into a collaborative, proactive, and security-conscious approach to influencing and integrating security across the business.

⚡ Challenges & Growth Opportunities

Challenges:

• Balancing Security and Speed: Ensuring robust security measures are implemented without hindering the rapid pace of product development and M&A integration.

• Influencing Stakeholders: Gaining buy-in and driving adoption of security best practices across diverse teams with varying priorities.

• Rapidly Evolving Threat Landscape: Staying ahead of new cyber threats and vulnerabilities, especially in dynamic areas like cloud computing and emerging technologies.

• Complexity of M&A Integration: Navigating the technical and security complexities of integrating diverse systems and cultures from acquired companies.

• Measuring Security ROI: Demonstrating the tangible business value and return on investment for security initiatives.

Learning & Development Opportunities:

• Specialized Certifications: Pursuing advanced certifications in cloud security, M&A security, or specific architecture frameworks.

• Industry Conferences & Training: Attending leading cybersecurity conferences and specialized training programs to stay current with threats, technologies, and best practices.

• Mentorship Programs: Engaging in internal mentorship opportunities to learn from senior leaders or mentor junior colleagues.

• Exposure to Global Projects: Working on a variety of international M&A deals and product launches provides broad exposure to different challenges and solutions.

• Developing Leadership Skills: Opportunities to lead cross-functional security initiatives and potentially manage direct reports or external resources.

📝 Enhancement Note: The role presents significant opportunities for professional growth by tackling complex, high-impact challenges in a rapidly evolving field, supported by Vodafone's commitment to learning and development.

💡 Interview Preparation

Strategy Questions:

• "Describe your approach to embedding 'Security by Design' into an agile development workflow. What are the key challenges and how do you overcome them?"

• "Walk us through a time you conducted technical due diligence for an M&A transaction. What were the critical security risks you identified, and how did you communicate them to stakeholders?"

• "How do you balance the need for robust security controls with the business's desire for speed and innovation? Provide an example."

• "Imagine a new product is being launched that relies heavily on third-party APIs. What steps would you take to ensure its security?" Company & Culture Questions:

• "What do you know about Vodafone's commitment to security and digital transformation?"

• "How do you see the 'Secure by Design' function contributing to Vodafone's overall business strategy?"

• "Describe your ideal team environment and how you foster collaboration within a hybrid work setting."

• "How would you handle a situation where a business unit strongly disagrees with a security requirement you've set?" Portfolio Presentation Strategy:

• Structure Your Case Studies: For each key project, clearly outline the challenge, your approach (methodology), the actions you took, the results achieved (quantified where possible), and lessons learned.

• Focus on Impact: Emphasize how your work directly contributed to risk reduction, compliance, business enablement, or financial benefits.

• Visual Aids: Use clear diagrams for architecture and process flows. Keep slides concise and focused.

• Know Your Audience: Tailor your presentation to the interviewer's background – highlight technical details for security peers and business impact for executives.

• Be Prepared for Q&A: Anticipate detailed questions about your methodologies, decisions, and the tools you used.

📝 Enhancement Note: Expect behavioral, situational, and technical questions. The interview will assess your ability to think strategically, communicate effectively, and demonstrate practical expertise in securing complex technology environments.

📌 Application Steps

To apply for this operations position:

• Submit your application through the provided link on the Vodafone Opportunities portal.

• Tailor Your Resume: Customize your resume to highlight experience in "Secure by Design," technical due diligence, security architecture, agile/DevSecOps, and cloud security. Use keywords from the job description.

• Prepare Your Portfolio: Curate 2-3 strong case studies that exemplify your experience in security assessments, M&A due diligence, or embedding security into product lifecycles. Quantify achievements where possible.

• Research Vodafone: Understand Vodafone's business, its commitment to security, and its recent M&A activities or product launches. This will help tailor your responses and demonstrate genuine interest.

• Practice Interview Questions: Rehearse answers to common cybersecurity, behavioral, and situational questions, focusing on your experience with "Secure by Design" and M&A integration.

⚠️ Important Notice: This enhanced job description includes AI-generated insights and operations industry-standard assumptions. All details should be verified directly with the hiring organization before making application decisions.

---