UK

United Kingdom · Technology and data · Lead (8-12 years)

Lead Vulnerability Management Engineer

Here is the whole job, in plain words. What it is, what you decide, how you're judged, how people get here and where they go next. Then the part no course gives you: twelve AI tutors who learn your work.

Start my Lead Vulnerability Management Engineer plan, free

Free to start: a plan built for this role, and a Future Fluency module to try first. No card.

Keep this job description

Where should we send it?

One email: what AI is changing in this job, and where to start free. With a link back here. Nothing else follows unless you confirm your address.

Upskilling a team in this role? Talk to us

  • Experience bandLead (8-12 years)
  • Direct reports3-5 reports
  • Reports toDirector of Threat & Vulnerability Management
  • UK framework levelUsually a manager, or the deepest specialist in a team

Also advertised as Senior Security Engineer (Vulnerability) · Principal Vulnerability Analyst · Security Architect (Vulnerability Management)

Built on 43,079 real UK job descriptions we analysed · grounded in qualifications employers recognise

Two short quizzes about you

1From this job to a course

The qualifications matched to this job

NCFE Level 3 Technical Occupational Entry in Cyber Security (Diploma) NCFE · Level 3 · covers 4 of 10 standards
ETCAL Level 3 NVQ Diploma in Engineering Technical Support ETC Awards Limited · Level 3 · covers 3 of 10 standards
EAL Level 3 NVQ Extended Diploma in Engineering Technical Support Excellence, Achievement & Learning Limited · Level 3 · covers 3 of 10 standards
EAL Level 3 Diploma in Advanced Manufacturing and Engineering - Technical Support Technician (Development Competence) Excellence, Achievement & Learning Limited · Level 3 · covers 2 of 10 standards
ATHE Level 7 Extended Diploma in Computing ATHE Ltd · Level 7 · covers 2 of 10 standards
ATHE Level 6 Award in Security Risk Management Consultancy ATHE Ltd · Level 6 · covers 1 of 10 standards

Matched from the standards this job is measured against: a suggestion, not an official ruling.

The units you would start with

Risk and vulnerability assessment NCFE Level 3 Technical Occupational Entry in Cyber Security (Diploma)
Performing Computer System Security Assessments for Engineering Software ETCAL Level 3 NVQ Diploma in Engineering Technical Support
Cyber Security Operations: Threat Analysis, Testing, and Incident Response ATHE Level 7 Extended Diploma in Computing
Information and Cyber Security ATHE Level 6 Award in Security Risk Management Consultancy

The future skills this job leans on

AI Fluency working with AI as a thinking partner
Data Fluency turning numbers into a decision
Systems Fluency seeing the whole picture
Trust Fluency keeping the digital world safe
Start my Lead Vulnerability Management Engineer plan, free
Your Plan Illustration

Built for Lead Vulnerability Management Engineer

4 units that map to this job, from the qualifications that cover it.

  1. Risk and vulnerability assessment NCFE · covers 4 of 10 standards Level 3
  2. Performing Computer System Security Assessments for Engineering Software ETC Awards Limited · covers 3 of 10 standards Level 3
  3. Cyber Security Operations: Threat Analysis, Testing, and Incident Response ATHE Ltd · covers 2 of 10 standards Level 7
  4. Information and Cyber Security ATHE Ltd · covers 1 of 10 standards Level 6
These are the real units behind this job, in the order they rank for it. Nothing here is marked done, because this plan has not been started by anyone yet. Yours would fill in as you go.

2AI and this work

Will AI change your work as a Lead Vulnerability Management Engineer?

Nobody can say exactly how. Here is what this job is being asked for next, and where to start.

The new skill this role is being asked for

  • Prompt Engineering & LLM Integration for Security
Why each one is rising

The future skills this job leans on

We'll only ever tell you what we can actually back up. No hype, no scare tactics.

What happens when you start

Next, a free account. We build your Lead Vulnerability Management Engineer plan as you set up, starting with a Future Fluency module on using AI in your job. No card.

Your first Future Fluency module is free. After that, your AI tutor is £70 a month.

Start my Lead Vulnerability Management Engineer plan, free Ready to pay? Subscribe for £70 a month

3What this role really is

This job means designing and building the system that finds, tracks and helps fix vulnerabilities across an organisation's systems. It involves making a vulnerability assessment programme smarter and faster, so systems hold up against evolving threats.

4What you'd actually use

The tools this job runs on, and how well you'd need to know each one.

Vulnerability Scanners (Tenable.io, Qualys Cloud Platform, Rapid7 InsightVM) Expert

Designing and configuring complex, enterprise-wide scan policies (authenticated scans, cloud connectors), tuning scanner performance, integrating scanner data with other platforms, and troubleshooting advanced scanning issues.

Dynamic/Static AppSec Tools (Burp Suite Pro, Veracode, Checkmarx) Advanced

Developing the application security testing programme, integrating SAST/DAST into CI/CD pipelines (DevSecOps), setting AppSec policies, and performing manual validation of complex DAST/SAST findings.

Network & Exploitation Tools (Nmap, Metasploit Framework, Wireshark) Expert

Writing advanced Nmap scripts (NSE), validating vulnerabilities using Metasploit modules, analyzing packet captures to diagnose exploits, and defining Rules of Engagement for penetration testing.

Threat Intelligence Platforms (Recorded Future, Mandiant Advantage, Anomali) Advanced

Correlating threat actor TTPs with internal vulnerabilities, proactively searching for threats targeting our specific tech stack and geography, and using intel to drive prioritisation and security investment decisions.

Remediation & GRC Platforms (Jira, ServiceNow GRC, Archer) Advanced

Designing and optimising Jira/ServiceNow workflows for vulnerability lifecycle management, creating risk acceptance documentation, building automated reporting dashboards, and owning GRC integrations.

Cloud Security Posture Mgmt. (AWS Security Hub, Microsoft Defender for Cloud, Palo Alto Prisma Cloud) Advanced

Investigating complex cloud security alerts, writing custom queries (e.g., KQL for Sentinel), helping architect secure cloud landing zones, and defining enterprise-wide cloud security policy.

Scripting & Automation (Python, PowerShell) Advanced

Writing robust scripts to interact with APIs (e.g., pull data from Tenable, create Jira tickets automatically), building custom tools for analysis, and championing 'Security as Code' initiatives across the team.

5What you get to decide, and how that grows

Power in a job isn't your title. It's what you're allowed to decide. Here's how it grows as you move up.

The choiceComing in Where you are nowThe step above
Vulnerability Prioritisation Framework Follows established framework, flags ambiguities to supervisor. Applies framework independently, suggests minor improvements. Designs and refines the framework, incorporating new data sources and threat intelligence. Owns the decision on framework updates.
Selection of Vulnerability Scanning Tools Uses assigned tools, reports on performance issues. Evaluates new features of existing tools, provides feedback. Leads the evaluation, selection, and procurement process for new scanning tools or major platform upgrades (up to £50K budget). Makes recommendations to Director for larger investments.
Automation Script Design & Deployment Modifies existing scripts under guidance, tests thoroughly. Develops new scripts for routine tasks, seeks peer review. Architects and implements complex automation solutions for critical programme functions. Owns the entire lifecycle of these scripts, from design to deployment and maintenance, including code reviews for team members.
Team Hiring & Performance Management No involvement. Participates in interviews, provides feedback on candidates. Full hiring authority for direct reports (3-5 analysts). Conducts performance reviews, sets objectives, and manages career development for team members. Consults Director on complex HR issues.

6How you'll be judged

The scoreboard, and what is not on it. The hard targets, how often each is actually looked at, and the quiet signals that never reach a dashboard.

Mean Time to Remediate (MTTR) for Critical/High Vulnerabilities
The average time it takes for critical and high-severity vulnerabilities to be fully patched or mitigated after discovery.
Target · Achieve a 15% quarter-over-quarter reduction in MTTR for criticals, and 10% for highs.

If Q1's critical MTTR was 20 days, Q2's target would be 17 days. You'll track this using our GRC platform dashboards.

Vulnerability Re-open Rate
The percentage of vulnerabilities that were marked 'fixed' but are subsequently found again in a later scan, indicating an incomplete or incorrect fix.
Target · Maintain a re-open rate below 5% for all validated vulnerabilities.

If 100 vulnerabilities were marked fixed last month, and 7 of them reappeared in this month's scan, your re-open rate would be 7% – meaning there's work to do on fix quality or verification.

Automation Coverage & Efficiency
The percentage of vulnerability lifecycle tasks (e.g., ticket creation, initial triage, data enrichment) that are automated, and the time saved as a result.
Target · Increase automation coverage by 20% year-on-year, aiming to reduce manual effort by at least 10 hours per week for your team.

You design a Python script that automatically pulls new critical findings from Tenable.io, enriches them with asset owner data, and creates Jira tickets. We'd measure the number of tickets processed this way and the estimated manual time saved.

Mentorship & Team Development
The successful onboarding and independent operation of junior analysts under your guidance.
Target · Ensure 1-2 junior analysts are successfully onboarded and operating independently on routine tasks within 6 months of joining.

Your two new team members are now confidently triaging medium-severity findings and running standard scans without needing daily check-ins, demonstrating your effective mentorship.

Programme Design & Improvement
The effectiveness and strategic foresight of the vulnerability management programme designs and improvements you implement.
  • Regular proposals for programme enhancements, successful integration of new tools or methodologies, positive feedback from the Director on strategic contributions, and the adoption of your designs by other security teams. We'll look for evidence of a well-thought-out, scalable approach to VM.
Cross-functional Influence & Collaboration
Your ability to influence and collaborate with development, operations, and cloud teams to embed security practices and drive remediation.
  • Being proactively consulted by other teams on security architecture decisions, successful negotiation of remediation timelines, positive feedback from peer leads on your collaborative approach, and the adoption of your suggested secure coding practices by development teams. It's about getting things done through influence, not just authority.
Technical Leadership & Problem Solving
Your ability to tackle complex, ambiguous vulnerability challenges and provide clear, actionable technical guidance to your team and stakeholders.
  • Successfully resolving 'unpatchable' vulnerabilities with creative mitigations, leading post-incident reviews related to vulnerability exposure, providing clear technical direction during complex investigations, and your team consistently seeking your input on tricky issues. You're the go-to person when things get complicated.

7Would you like it

Both sides. What people enjoy, and what grinds them down.

What people enjoy
Building & Optimising Systems

You get a real kick out of designing a new workflow in Jira for vulnerability tracking, or writing a Python script that automates a tedious manual task. You're always thinking 'how can we do this better, at scale?'

You spend a Friday afternoon sketching out a new integration between our cloud security posture management tool and our ticketing system, excited by the idea of reducing manual alert handling by 30%.

Solving Complex, Ambiguous Problems

When faced with a 'zero-day' or a particularly tricky legacy system vulnerability, you're not overwhelmed; you're energised. You love digging into the unknown, researching, and piecing together a solution where none seems obvious.

A critical vulnerability is reported in a bespoke application that hasn't been updated in years. Instead of shrugging, you dive into its architecture diagrams, research virtual patching options, and propose a multi-layered mitigation strategy.

Having Tangible Impact on Security Posture

You're driven by seeing the numbers move. A reduction in MTTR, a lower re-open rate, or a successful programme rollout that demonstrably reduces risk – that's what gets you going. You want to see your work make a real difference.

After implementing a new prioritisation framework, you see a significant drop in the number of high-severity vulnerabilities past their SLA, and you know your work directly contributed to that improved security.

What frustrates people
  • Constant pushback from asset owners on remediation timelines or perceived false positives.
  • Dealing with legacy systems that are genuinely difficult or impossible to patch.
  • The slow pace of change in a large organisation, especially when implementing new security processes.
  • Having to repeatedly educate non-technical stakeholders on fundamental security risks.
  • The sheer volume of alerts and findings, making it hard to focus on what truly matters.
What this role does not give you
  • A quiet, predictable, 'head-down' coding environment – you'll be interacting with people constantly.
  • Direct control over development or infrastructure teams – you influence, you don't command.
  • Immediate, visible resolution of every single issue you identify – some things take months, or even years, to fix.
  • A role where you can avoid documentation or process improvement – that's a core part of the job.

8Who you work with

You'll directly shape the effectiveness of our preventative security measures, reducing the likelihood of successful cyberattacks. Your work ensures that identified weaknesses are not just reported, but systematically addressed, protecting our assets and maintaining trust with our customers and partners. Essentially, you're building the early warning system for our entire digital estate.

Inside the business
  • Security Operations Centre (SOC) Lead
  • Cloud Engineering Leads
  • Application Development Managers
  • IT Infrastructure Teams
  • Risk & Compliance Officers
Outside the business
  • Third-party penetration testing vendors
  • Security tool vendors (e.g., Tenable, Qualys)
  • External auditors (occasionally for programme validation)

9What you need before you start

Not a wish list. The things you would be expected to already have.

  • At least 5 years of hands-on experience as a Senior Vulnerability Assessment Analyst or a similar technical security role, where you were responsible for validating and triaging high-severity findings.
  • Demonstrable experience leading complex vulnerability assessments and guiding junior team members, even if informally.
  • Proven ability to write and maintain automation scripts (Python, PowerShell) for security tasks.
  • A strong track record of influencing technical and non-technical stakeholders to achieve security outcomes.
  • Deep understanding of network protocols, operating systems (Windows, Linux), and common web application vulnerabilities (OWASP Top 10).

10What to practise next

Where the job is going, and what to do about it starting this week.

Security Orchestration, Automation, and Response (SOAR) Design

Manual security operations simply can't keep up with the volume and sophistication of threats. Designing and implementing SOAR playbooks will be crucial for automating repetitive tasks, accelerating incident response, and ensuring consistent vulnerability remediation workflows.

Playbook Development · API Integrations · Workflow Optimisation · Exception Handling

  • This week: Research leading SOAR platforms (e.g., Splunk SOAR, Palo Alto Cortex XSOAR) and their capabilities.
  • This month: Map out one end-to-end vulnerability response process (e.g., critical finding to remediation) and identify automation opportunities.
  • Month 2: Experiment with a free or trial SOAR platform to build a simple playbook for automated ticket creation from a scanner alert.
  • Month 3: Propose a SOAR integration strategy for our vulnerability management programme to the Director.

Quick win: Identify one highly repetitive, manual task in your current workflow and sketch out how a simple SOAR playbook could automate it.

Cloud-Native Security (Kubernetes, Serverless, Containers)

Our infrastructure is increasingly moving to cloud-native architectures. Understanding how vulnerabilities manifest in these environments, and how to secure them, is no longer optional. You'll need to design assessment strategies for these new paradigms.

Container Security Best Practices · Kubernetes Security Controls · Serverless Vulnerabilities · Infrastructure as Code (IaC) Security

  • This week: Complete an introductory course on Kubernetes or serverless computing (e.g., on Coursera or Udemy).
  • This month: Research common vulnerabilities in containerised applications and how our current scanners address them (or don't).
  • Month 2: Work with a Cloud Engineer to understand our current cloud-native deployments and identify potential security gaps.
  • Month 3: Propose a strategy for integrating cloud-native vulnerability scanning and posture management into our existing programme.

Quick win: Review the OWASP Top 10 for Kubernetes or Serverless and compare it against our current cloud security posture reports.

11Staying current once you are in

What people here do to keep up
  • Regularly attend industry conferences (e.g., Black Hat, DEF CON, RSA Conference) to stay current with emerging threats and technologies.
  • Actively participate in security communities and forums (e.g., OWASP, SANS Internet Storm Centre) to share knowledge and learn from peers.
  • Contribute to open-source security projects or develop personal security tools to hone your scripting and automation skills.
  • Pursue advanced training in areas like cloud security architecture, SOAR engineering, or advanced exploitation techniques.
  • Read security research papers and threat intelligence reports to deepen your understanding of the adversary landscape.

12The rising capability

The rising capability

Zavmo analysis

What's rising in its place

This is where the work is heading, and the higher pay with it. Get fluent here and the shift stops being a threat and starts being your edge.

Prompt Engineering & LLM Integration for Security

Competitors are already using Large Language Models (LLMs) to draft vulnerability reports, summarise threat intelligence, and even suggest remediation steps in minutes, not hours. Analysts who master this will significantly outproduce their peers and elevate the quality of their output.

  • Context Windows & Token Limits
  • Temperature Settings for Different Tasks
  • RAG (Retrieval Augmented Generation) Architectures
  • Output Validation & Hallucination Detection
  • Prompt Chaining for Complex Analysis

13What you’ll use

What you’ll use

Skills this role draws on

Technical

  • CVSS v3.1/v4.0 Scoring & Interpretation
  • Threat- & Risk-Based Prioritisation
  • MITRE ATT&CK & D3FEND Frameworks
  • Vulnerability Lifecycle Management (VLCM)
  • Cloud Security Principles & Architecture
  • Network & Application Architecture Analysis

14The pathway

The pathway

How you actually get there, here

How you become one varies far more by country than what one does. This is the UK route. Most people take one of these ways in; the right one depends on where you're starting from.

  1. 1

    Senior Vulnerability Assessment Analyst

    3-5 years in a senior role

    Skills to master

    • Deep technical validation of high-risk findings, effective communication with development teams, initial automation scripting, and informal mentorship of junior colleagues. You'd be owning complex assessments end-to-end.

    You're ready to move on when

    • Consistently delivering accurate, high-quality vulnerability reports.
    • Proactively identifying and proposing solutions for recurring vulnerability patterns.
    • Successfully leading small, complex vulnerability assessment projects.
    • Receiving positive feedback on your ability to mentor and guide less experienced analysts.
  2. 2

    Security Engineer (AppSec/Cloud Security)

    4-6 years in a specialised security engineering role

    Skills to master

    • Hands-on experience with application security testing (SAST/DAST), secure coding practices, cloud security architecture, and integrating security into CI/CD pipelines. You'd bring a strong 'builder' perspective.

    You're ready to move on when

    • Successfully designed and implemented security controls in cloud environments.
    • Contributed to secure software development lifecycle improvements.
    • Deep understanding of developer workflows and how to embed security without being a blocker.
    • Proven ability to troubleshoot and solve complex security engineering problems.

15Where this role leads

The long view: This work can lead to leading security teams, shaping enterprise security strategy, or becoming a senior technical specialist in vulnerability management.

The ten Future Fluencies

Zavmo analysis

The credential is what you can do today. These are what keep you valuable.

A qualification proves you can do the job as it's defined today. These ten are what decide whether you're still the obvious person for it in five years. They're the capabilities employers are now writing into senior roles faster than people are learning them. Zavmo weaves them through whatever you study, so you come out with both: the credential and the fluency.

The highlighted ones are the Fluencies your role leans on hardest, from how Lead Vulnerability Management Engineer is actually changing.

Where it leads

Roles this leads to

How you would learn this

One to one, on the work you already do

A tutor sets the task against your own job and marks the reasoning, at your pace. There is no cohort to fall behind.

A lesson from Risk and vulnerability assessment, worked against Lead Vulnerability Management Engineer.

Risk and vulnerability assessment Level 3

Applied to your work in Lead Vulnerability Management Engineer

This unit aims to provide learners with an understanding of cyber security vulnerabilities, risks, and vulnerability assessments, including the principles of computer forensics. Learners will develop the ability to categorise risks for escalation and evaluate assessments to protect organisational assets.

How the thinking builds
  1. 1 Remember
  2. 2 Understand
  3. 3 Apply
  4. 4 Analyse
  5. 5 Evaluate
  6. 6 Create
An illustration of a Zavmo lesson, built from this role’s own route. The unit, its objective and every criterion above are the awarding body’s own words, not an example.

It is £70 a month, billed monthly. Your free first module is Future Fluency, and you can cancel any time.

Start my Lead Vulnerability Management Engineer plan, free
See Your Progress Grow Illustration
Lead Vulnerability Management Engineer
  • CVSS v3.1/v4.0 Scoring & Interpretation
  • Threat- & Risk-Based Prioritisation
  • MITRE ATT&CK & D3FEND Frameworks
  • Vulnerability Lifecycle Management (VLCM)
  • Cloud Security Principles & Architecture
  • Network & Application Architecture Analysis
This is your Mind Palace on learn.zavmo.ai. Every skill above comes from this role's own record, not an example borrowed from another job. A node lights up when you evidence it, and what you build stays yours between jobs. That is the part a course cannot do.

16The detail, folded away

Everything else the record holds

The career branches in full, how AI is already showing up in the day-to-day, and the questions people ask about this job. Here when you want them, out of the way while you decide.

Where it leads next, rung by rung

Where it leads

The career path, and where it branches

Lead Vulnerability Management Engineer is a start, not a ceiling. Each step below asks for new skills and hands back more autonomy.

  1. Principal Security Architect / VM Program Manager (Level 005)

    3-5 years in the Lead role

    This is a significant step up, moving from designing specific programme components to owning the entire vulnerability management strategy, managing vendor relationships, setting enterprise-wide policy, and reporting on the overall risk posture to executive leadership. You'd be leading a larger team, potentially with other managers reporting to you.

    • Enterprise Risk Management Integration Aligning VM with the broader enterprise risk framework.
    • Budget Management Owning and managing the multi-million-pound budget for the VM programme.
    • Policy Development Writing and enforcing enterprise-wide security policies related to vulnerability management.
    • Maturity Model Implementation Driving improvements in our security maturity based on frameworks like CMMI or NIST.
Working with AI on the job

Working with AI

Where AI is starting to help

Let's be real, vulnerability management can be a bit of a grind. Sifting through thousands of alerts, writing endless reports, and chasing up remediation tickets can eat up your week. But what if you could offload the repetitive, time-consuming tasks to AI, freeing you up to focus on the truly strategic, high-impact work? That's exactly what we're doing here.

As a Lead Vulnerability Management Engineer, you're not just doing the work; you're designing the process. AI isn't here to replace you; it's here to be your co-pilot, helping you build a more efficient, intelligent, and proactive security programme. Imagine what you could achieve if your team spent less time on manual triage and more time on deep analysis, threat hunting, and strategic defence. Here's a glimpse of how AI will transform your day-to-day:

Automated Triage & Prioritisation

AI ingests raw scan data from all our tools, automatically enriches it with asset criticality from our CMDB, and pulls in real-time threat intelligence. It then assigns a 'true risk' score, flagging the top 1% of vulnerabilities that pose an immediate, existential threat to the business. You'll review the AI's top picks, not thousands of alerts.

Predictive Exploit Analysis

Our AI analyses vulnerability characteristics against a massive dataset of past exploits and active threat campaigns. It predicts the likelihood of a new vulnerability being exploited in the wild within the next 30 days, allowing your team to patch proactively before an exploit is even public. This shifts us from reactive to predictive defence.

Rapid Zero-Day Summarisation

When a new major vulnerability (think Log4j or similar) breaks, AI instantly scours dozens of technical blogs, security vendor reports, and social media feeds. It generates a concise, one-page executive summary for leadership: what it is, what systems are affected, and the top 3 recommended mitigation steps. You get the critical info in minutes, not hours.

Business-Impact Report Generation

AI helps draft remediation tickets and reports, translating complex technical jargon ('Authenticated RCE in Apache Struts') into clear, concise business impact ('This allows an attacker with basic user access to take full control of the server hosting our customer payment portal.'). This saves your team hours of manual report writing and ensures everyone understands the true risk.

Common questions

Common questions

How do you become a Lead Vulnerability Management Engineer?

Common routes in include Senior Vulnerability Assessment Analyst (3-5 years in a senior role) and Security Engineer (AppSec/Cloud Security) (4-6 years in a specialised security engineering role). Times vary with prior experience.

Where can a Lead Vulnerability Management Engineer progress to?

This role can lead on to Principal Security Architect / VM Program Manager (3-5 years in the Lead role), depending on the skills you build.

What new skills matter most for a Lead Vulnerability Management Engineer?

Increasingly, Prompt Engineering & LLM Integration for Security. These are the skills our record of this role lists as growing.

Free tools

Want a read on where you stand?

Three free tools, no account needed. Each one ends with a role, a level and a way in.

Read the Zavmo manifesto to understand how you will be taught Meet your tutors

Or try another one

17Where to go from here

Other roles at Level 5

Same depth of qualification, different job. Useful if the work appeals but this particular role does not.

 More jobs in technology and data

Stay in the field you know and move sideways rather than up.
If you leave this industry

The skills built here, technical vulnerability expertise, programme design, automation and working across teams, transfer well. They can lead to security consulting, work with a security product vendor designing scanning tools, or broader security architecture and risk management roles in most industries that take security seriously.

This role profile is © 2026 Growth Engineering Technologies Ltd. Built from UK occupational standards and regulated qualification data, and written for Zavmo.

You're not behind. You're right on time. The shift is only just beginning. Your role won't look the same in two years. Be the one who leads the change, not the one it happens to. Start my Lead Vulnerability Management Engineer plan, free What happens next: a free account, then we build your plan as you set up. No card. Build your plan, see your roadmap and meet the twelve tutors matched to you. All free. When you're ready to start learning, it's £70 a month, billed monthly. Cancel any time and billing stops.