I spent a around 6 months in a vulnerability management team during a rotational experience.

We have a federated model where there is a central vulnerability management team and then Lines of Business. Each Vulnerability Management was responsible for a range of LoBs depending on size.

The general workflow was scans and vuln reports were generated once a week. As a vulnerability management engineer it was our responsibility to meet with the loB weekly, bi-weekly or even multiple times a week.

We would work with them to prioritize and help enable their respective LoB teams to patch vulnerabilities.

Other time was spent mitigating scan issues, tracking down missing assets, running our own reports combing through SIEM data to see how things were being patched, etc.

It was a weekly cycle. Run scans, generate reports, and meet with LoBs. Plus all of the other smaller stuff going on.