Drive the maturity of the vulnerability management program through adoption of risk-based prioritization frameworks, automation, and integration with broader security operations
Report on program performance, risk posture, and strategic initiatives to senior leadership and executive stakeholders.
Vulnerability Assessment & Analysis
Oversee the execution of regular vulnerability scans across infrastructure, endpoints, applications, cloud environments, and third-party assets
Ensure accurate analysis and validation of scan results, including the identification of true positives, elimination of false positives, and assessment of exploitability and business impact.
Direct deeper technical analysis on complex, critical, or high-risk vulnerabilities, including correlation with threat intelligence and exploit activity.
Evaluate and implement risk-based prioritization methodologies (e.g., CVSS, EPSS, SSVC) to ensure remediation efforts are focused on the highest-risk exposures.
Remediation Governance & Coordination
Drive and coordinate remediation activities across IT Infrastructure, Application Development, Cloud Engineering, and business units, ensuring accountability and adherence to defined SLAs
Establish remediation tracking mechanisms, escalation paths, and exception management processes for vulnerabilities that cannot be immediately addressed.
Approve and oversee compensating controls, risk acceptances, and remediation deferrals in alignment with the organization's risk management framework
Validate remediation effectiveness through re-scanning, verification, and closure processes.
Team Leadership & Development
Lead, mentor, and develop the vulnerability management team, including Level 1 and Level 2 analysts.
Define roles, responsibilities, and performance expectations for team members.
Foster a culture of continuous learning, technical excellence, and proactive security within the team.
Identify skill gaps and drive training, certification, and professional development initiatives.
Stakeholder Engagement & Communication
Serve as the primary point of contact for vulnerability management matters across the organization.
Communicate vulnerability risks, remediation priorities, and program status to technical teams, business leaders, and executive management.
Build and maintain strong relationships with asset owners, system administrators, and business unit leaders to ensure collaboration and accountability.
Coordinate with Threat Intelligence, Penetration Testing, and Security Operations teams to align vulnerability findings with broader security initiatives and threat landscape developments.
Governance, Risk & Compliance
Ensure the vulnerability management program meets regulatory, audit, and compliance requirements.
Provide evidence of vulnerability management controls, scan results, remediation status, and risk acceptances for audit and compliance activities.
Identify systemic vulnerability trends and recommend strategic improvements to reduce the organization's attack surface. • Align vulnerability management practices with relevant frameworks and standards (e.g., ISO/IEC 27001:2022, NIST CSF, CIS Controls).
Metrics, Reporting & Continuous Improvement
Define, track, and report key vulnerability management metrics, including mean time to remediate (MTTR), scan coverage, SLA adherence, vulnerability aging, and risk reduction trends.
Develop and maintain executive dashboards and reports to provide visibility into the organization's vulnerability posture.
Lead continuous improvement initiatives to enhance vulnerability detection, prioritization, remediation, and reporting capabilities.
Evaluate emerging tools, technologies, and methodologies to strengthen the vulnerability management program.
Stay current on emerging vulnerabilities, exploit techniques, threat landscape developments, and industry best practices.
QUALIFICATIONS
Experience
6–10 years of experience in Information Security, with at least 3 years in a vulnerability management or security operations leadership role.
Proven experience leading and managing a vulnerability management program in an enterprise environment.
Demonstrated experience in cross-functional coordination, driving remediation across diverse IT and business teams.
Experience with vulnerability management in hybrid environments (on-premises, cloud, and multi-cloud) is strongly preferred.
Technical Skills
Deep understanding of vulnerability assessment methodologies, CVSS scoring, and risk-based prioritization frameworks (e.g., EPSS, SSVC). • Strong knowledge of networking protocols, operating systems (Windows, Linux), cloud platforms, and common enterprise technologies.
Experience with enterprise vulnerability scanning platforms and their configuration, tuning, and integration.
Familiarity with asset management, CMDB, ITSM, and SIEM platforms for vulnerability correlation and enrichment.
Understanding of common vulnerability types (e.g., OWASP Top 10, CWE/SANS Top 25), exploit techniques, and attack vectors.
Scripting and automation skills (e.g., Python, PowerShell, Bash) for scan automation, data analysis, and reporting.
Knowledge of patch management processes, change management workflows, and configuration management practices.
Soft Skills
Strong leadership and people management skills with the ability to build, motivate, and develop high-performing teams.
Excellent communication and presentation skills, with the ability to convey complex technical risks to executive and non-technical audiences.
Strategic thinking with the ability to balance tactical execution and long-term program maturity.
Strong stakeholder management and influencing skills, with the ability to drive accountability across teams without direct authority.
Proactive, results-oriented mindset with a commitment to continuous improvement.
Certifications
CISSP (Certified Information Systems Security Professional)
CISM (Certified Information Security Manager)
GIAC Vulnerability Assessment (GEVA) or GIAC Certified Enterprise Defender (GCED)
CompTIA CySA+ (Cybersecurity Analyst)
Relevant vendor-specific certifications in vulnerability management platforms
Other advanced cybersecurity certifications
PHYSICAL & ENVIRONMENTAL DEMANDS
N/A
TIME TRAVEL REQUIRED
N/A
