POSITION SUMMARY
The Vulnerability Manager is responsible for leading and overseeing the organization's vulnerability management program, ensuring the timely identification, assessment, prioritization, and remediation of security vulnerabilities across the enterprise environment. This role is accountable for defining vulnerability management strategy, establishing governance frameworks, driving cross-functional remediation efforts, and providing executive-level visibility into the organization's vulnerability posture.
The Vulnerability Manager works closely with Security Operations, IT Infrastructure, Application Development, Cloud Engineering, Risk Management, and senior leadership to ensure vulnerabilities are systematically managed in alignment with the organization's risk appetite and regulatory obligations. The ideal candidate possesses strong leadership capabilities, deep technical expertise in vulnerability assessment and remediation, and the ability to influence stakeholders at all levels to drive measurable risk reduction.
RESPONSIBILITIES
Program Leadership & Strategy
- Own and lead the end-to-end vulnerability management program, including strategy, governance, policies, and operational execution
- Define and maintain vulnerability management policies, standards, procedures, and SLAs aligned with industry frameworks and organizational risk appetite.
-
Establish and continuously improve vulnerability management workflows, playbooks, and escalation procedures.
Drive the maturity of the vulnerability management program through adoption of risk-based prioritization frameworks, automation, and integration with broader security operations
- Report on program performance, risk posture, and strategic initiatives to senior leadership and executive stakeholders.
Vulnerability Assessment & Analysis
- Oversee the execution of regular vulnerability scans across infrastructure, endpoints, applications, cloud environments, and third-party assets
- Ensure accurate analysis and validation of scan results, including the identification of true positives, elimination of false positives, and assessment of exploitability and business impact.
- Direct deeper technical analysis on complex, critical, or high-risk vulnerabilities, including correlation with threat intelligence and exploit activity.
-
Evaluate and implement risk-based prioritization methodologies (e.g., CVSS, EPSS, SSVC) to ensure remediation efforts are focused on the highest-risk exposures.
Remediation Governance & Coordination
- Drive and coordinate remediation activities across IT Infrastructure, Application Development, Cloud Engineering, and business units, ensuring accountability and adherence to defined SLAs
- Establish remediation tracking mechanisms, escalation paths, and exception management processes for vulnerabilities that cannot be immediately addressed.
- Approve and oversee compensating controls, risk acceptances, and remediation deferrals in alignment with the organization's risk management framework
-
Validate remediation effectiveness through re-scanning, verification, and closure processes.
Team Leadership & Development
- Lead, mentor, and develop the vulnerability management team, including Level 1 and Level 2 analysts.
- Define roles, responsibilities, and performance expectations for team members.
- Foster a culture of continuous learning, technical excellence, and proactive security within the team.
-
Identify skill gaps and drive training, certification, and professional development initiatives.
Stakeholder Engagement & Communication
- Serve as the primary point of contact for vulnerability management matters across the organization.
- Communicate vulnerability risks, remediation priorities, and program status to technical teams, business leaders, and executive management.
- Build and maintain strong relationships with asset owners, system administrators, and business unit leaders to ensure collaboration and accountability.
-
Coordinate with Threat Intelligence, Penetration Testing, and Security Operations teams to align vulnerability findings with broader security initiatives and threat landscape developments.
Governance, Risk & Compliance
- Ensure the vulnerability management program meets regulatory, audit, and compliance requirements.
- Provide evidence of vulnerability management controls, scan results, remediation status, and risk acceptances for audit and compliance activities.
- Identify systemic vulnerability trends and recommend strategic improvements to reduce the organization's attack surface. • Align vulnerability management practices with relevant frameworks and standards (e.g., ISO/IEC 27001:2022, NIST CSF, CIS Controls).
Metrics, Reporting & Continuous Improvement
- Define, track, and report key vulnerability management metrics, including mean time to remediate (MTTR), scan coverage, SLA adherence, vulnerability aging, and risk reduction trends.
- Develop and maintain executive dashboards and reports to provide visibility into the organization's vulnerability posture.
- Lead continuous improvement initiatives to enhance vulnerability detection, prioritization, remediation, and reporting capabilities.
- Evaluate emerging tools, technologies, and methodologies to strengthen the vulnerability management program.
-
Stay current on emerging vulnerabilities, exploit techniques, threat landscape developments, and industry best practices.
QUALIFICATIONS
Experience
- 6–10 years of experience in Information Security, with at least 3 years in a vulnerability management or security operations leadership role.
- Proven experience leading and managing a vulnerability management program in an enterprise environment.
- Demonstrated experience in cross-functional coordination, driving remediation across diverse IT and business teams.
- Experience with vulnerability management in hybrid environments (on-premises, cloud, and multi-cloud) is strongly preferred.
Technical Skills
- Deep understanding of vulnerability assessment methodologies, CVSS scoring, and risk-based prioritization frameworks (e.g., EPSS, SSVC). • Strong knowledge of networking protocols, operating systems (Windows, Linux), cloud platforms, and common enterprise technologies.
- Experience with enterprise vulnerability scanning platforms and their configuration, tuning, and integration.
- Familiarity with asset management, CMDB, ITSM, and SIEM platforms for vulnerability correlation and enrichment.
- Understanding of common vulnerability types (e.g., OWASP Top 10, CWE/SANS Top 25), exploit techniques, and attack vectors.
- Scripting and automation skills (e.g., Python, PowerShell, Bash) for scan automation, data analysis, and reporting.
- Knowledge of patch management processes, change management workflows, and configuration management practices.
Soft Skills
- Strong leadership and people management skills with the ability to build, motivate, and develop high-performing teams.
- Excellent communication and presentation skills, with the ability to convey complex technical risks to executive and non-technical audiences.
- Strategic thinking with the ability to balance tactical execution and long-term program maturity.
- Strong stakeholder management and influencing skills, with the ability to drive accountability across teams without direct authority.
- Proactive, results-oriented mindset with a commitment to continuous improvement.
Certifications
CISSP (Certified Information Systems Security Professional)
PHYSICAL & ENVIRONMENTAL DEMANDS
TIME TRAVEL REQUIRED
