Vulnerability Management outside IR35 jobs
An outside IR35 Vulnerability Management job is a contract the client says sits beyond the off-payroll rules, so you can invoice through your own limited company. The work itself is still finding, prioritising and chasing the fixes for known weaknesses. The status is a tax determination, not a description of the skill.
Updated 1 November 20264 min read
What outside IR35 means on a Vulnerability Management contract
Outside IR35 means the engagement is treated as a business-to-business supply of Vulnerability Management, not as employment in all but name. You invoice your company rate. You do not have the client's holiday, pension or employment rights, and you carry the admin of a limited company. That trade is why contractors filter for outside roles first.
The client, or the agency where the client is a small company, makes the determination and should be able to show it. A sentence in an advert is a signal. It is not the status determination statement. How IR35 status is decided walks through what you can ask for.
How often Vulnerability Management roles are outside
Vulnerability Management contracts are genuinely mixed. Product companies and smaller clients more often advertise outside IR35. Large programmes, and anything with a body-shop agency in the chain, more often advertise inside. Treat "outside" as a claim to check, not as a promise, and price an inside offer against take-home rather than against the headline.
Regulated firms, government, and any board that has just had a finding it cannot leave until next year do not share one policy. Two Vulnerability Management adverts in the same week can land on opposite sides because the working practices differ, or because one client blankets a programme and the other does not. Filter the claim, then confirm it.
What to check before you accept
Look at substitution, control and whether you are part and parcel of the organisation. A Vulnerability Management contractor who is told the hours, the method and the laptop, and who cannot send someone else, is harder to defend as outside even if the advert says it. The inside and outside IR35 guide is the short version of that difference.
Price the rate on both sides with the IR35 calculator. A move from outside to inside halfway through a renewal is a pay cut unless the day rate moves with it. Vulnerability Management day rates has the band clients are advertising.
Where to find them
Outside IR35 jobs is every live contract on the board that states outside, across every skill. Vulnerability Management contract jobs is the wider market, including inside and unstated roles. The apply link on each job is for members, so the original advert is not sitting open on the public page.
Geography follows the rest of the Vulnerability Management market: London, Manchester, Cheltenham-adjacent remote roles, Bristol and Edinburgh. Remote outside IR35 roles exist and are competed for harder than a hybrid seat in one city.
Live roles on the board
These Vulnerability Management contracts are on the board now. The day rate and IR35 status are public. The link to the original advert is for members.
- Infrastructure Engineer - Security, Resilience & Recovery — Milton Keynes, Buckinghamshire, £400-£470/day Outside
- Infrastructure Engineer — Buckinghamshire, £400-£475/day Outside
See live Vulnerability Management contracts · Membership unlocks apply links and the first 48 hours