This
position
is
listed
on
behalf
of
a
partner
company,
which
manages
all
applications
and
next
steps.
Our
partner
is
looking
for
a
Senior
Director
–
Security
Posture
&
Exposure
Management
based
in
the
United
States
.
The
Senior
Director
will
lead
enterprise-wide
vulnerability
management
and
security
exposure
reduction
across
complex
technology
environments.
This
strategic,
hands-on
leadership
role
is
responsible
for
identifying
security
weaknesses,
assessing
their
real-world
risk,
and
ensuring
timely
remediation
across
cloud,
on-premises
infrastructure,
applications,
endpoints,
and
specialized
environments.
You
will
oversee
multiple
security
functions,
including
vulnerability
management,
application
security,
offensive
security,
advanced
vulnerability
discovery,
and
exposure
reporting.
By
combining
deep
technical
expertise
with
organizational
leadership,
you
will
transform
vulnerability
scanning
into
a
risk-based,
data-driven
security
capability.
Working
closely
with
technology
leaders,
security
operations,
and
risk
management
teams,
you
will
strengthen
accountability
and
improve
the
organization's
overall
security
posture.
This
is
an
opportunity
to
shape
enterprise
security
strategy,
develop
high-performing
teams,
and
deliver
measurable
reductions
in
cyber
risk.
Accountabilities
Define
enterprise
vulnerability
management
strategy:
Own
the
technical
strategy,
architecture,
operating
model,
roadmap,
and
performance
outcomes
for
end-to-end
vulnerability
management
across
cloud
environments,
on-premises
infrastructure,
applications,
endpoints,
and
operational
technology
or
laboratory
systems.
Lead
security
teams
and
organizational
development:
Manage
and
develop
leaders
and
teams
across
vulnerability
management,
application
security,
offensive
security,
advanced
vulnerability
discovery,
finding
validation,
prioritization,
and
exposure
reporting.
Establish
clear
priorities,
develop
talent,
and
maintain
accountability
for
results.
Oversee
enterprise
scanning
and
discovery:
Direct
the
architecture
and
performance
of
the
enterprise
scanning
environment,
including
asset
coverage,
scan
health,
authenticated
and
agent-based
scanning,
asset
reconciliation,
tooling
selection,
and
integration
with
ticketing
systems,
configuration
management
databases,
and
reporting
platforms.
Establish
risk-based
prioritization:
Develop
and
enforce
prioritization
frameworks
that
incorporate
vulnerability
severity,
exploitability,
threat
intelligence,
asset
criticality,
and
exposure
context.
Ensure
findings
are
validated
and
resources
are
focused
on
the
weaknesses
that
pose
the
greatest
business
risk.
Drive
remediation
and
accountability:
Establish
remediation
service-level
agreements
(SLAs),
escalation
procedures,
exception
processes,
and
clear
ownership
models.
Work
with
technology
owners
and
their
leadership
to
accelerate
remediation
and
demonstrate
measurable
improvements.
Oversee
application
and
offensive
security
programs:
Integrate
application
security
findings
into
enterprise-wide
vulnerability
management,
including
static
and
dynamic
application
security
testing
and
software
composition
analysis.
Guide
offensive
security
and
advanced
discovery
activities,
ensuring
findings
lead
to
systemic
improvements
rather
than
isolated
fixes.
Manage
exposure
reporting
and
analytics:
Own
executive
reporting,
technology-owner
scorecards,
risk
trends,
remediation
progress,
and
the
underlying
data
pipelines
and
metrics.
Ensure
reporting
is
accurate,
actionable,
and
suitable
for
executive
decision-making
and
audit
review.
Provide
technical
leadership
and
escalation:
Serve
as
the
senior
technical
authority
for
disputed
findings,
severity
assessments,
exploitability
decisions,
false
positives,
and
risk
exceptions.
Evaluate
scanning
configurations
and
prioritization
models,
identify
coverage
gaps,
and
direct
improvements.
Coordinate
with
security
and
technology
stakeholders:
Partner
with
security
operations,
incident
response,
threat
intelligence,
risk
and
compliance,
internal
audit,
platform
owners,
and
application
teams
to
prioritize
actively
exploited
vulnerabilities
and
incorporate
lessons
from
security
incidents.
Manage
risk
acceptance
and
mitigation:
Document
mitigation
strategies
and
oversee
risk
acceptance
when
vulnerabilities
cannot
be
fully
eliminated,
ensuring
residual
exposure
is
accurately
communicated
and
approvals
meet
audit
and
governance
requirements.
Oversee
budgets
and
external
partnerships:
Manage
departmental
budgets,
vendor
relationships,
contracts,
and
workforce
planning,
including
external
and
offshore
resources,
to
ensure
effective
delivery
and
operational
scalability.
Requirements
High
school
diploma
or
equivalent,
with
at
least
4
years
of
experience
in
cybersecurity,
information
technology,
or
a
related
field.
At
least
10
years
of
hands-on
professional
cybersecurity
experience,
primarily
in
vulnerability
management,
security
operations,
offensive
security,
or
a
closely
related
discipline.
At
least
5
years
of
experience
leading
a
security
function,
with
a
minimum
of
3
years
managing
people
leaders.
Extensive
practical
experience
with
vulnerability
management
platforms,
security
scanning,
exploitability
analysis,
attack
surface
management,
and
remediation
operations
across
hybrid
cloud
and
on-premises
environments.
Experience
with
operational
technology
or
regulated
laboratory
environments
is
an
advantage.
Proven
ability
to
lead
enterprise-scale
security
organizations,
manage
multiple
teams
through
their
leaders,
establish
strategic
priorities,
and
deliver
measurable
improvements
in
security
performance.
Strong
understanding
of
application
security
practices,
including
static
and
dynamic
application
security
testing
(SAST/DAST),
software
composition
analysis,
and
secure
software
development,
with
the
ability
to
integrate
application
findings
into
enterprise
vulnerability
management.
Demonstrated
expertise
in
developing
risk-based
prioritization
models
that
technology
teams
trust
and
use
to
guide
remediation
decisions.
Experience
implementing
remediation
SLAs,
escalation
mechanisms,
and
accountability
frameworks
that
improve
remediation
speed
and
outcomes.
Working
knowledge
of
offensive
security
and
red-team
practices,
including
the
ability
to
assess
findings,
guide
testing
priorities,
and
translate
discoveries
into
sustainable
security
improvements.
Experience
designing
or
modernizing
security
tooling
architectures,
automation
capabilities,
integrations,
and
data
pipelines
to
improve
coverage,
reliability,
and
operational
efficiency.
Strong
analytical
and
data
management
skills,
including
defining
meaningful
metrics,
validating
data
quality,
identifying
coverage
gaps,
and
communicating
exposure
trends
and
risk
decisions
clearly.
Excellent
leadership,
communication,
and
stakeholder
management
skills,
with
the
ability
to
influence
senior
technology
leaders
and
drive
action
beyond
direct
reporting
relationships.
Strong
judgment
and
problem-solving
capabilities,
particularly
when
evaluating
vulnerability
findings,
balancing
competing
risks,
and
allocating
remediation
resources
effectively.
A
bachelor's
degree
in
cybersecurity,
computer
science,
information
technology,
or
a
related
field
is
preferred.
Benefits
Annual
salary:
$159,000–$257,400,
depending
on
qualifications,
experience,
and
geographic
location.
Performance
incentives:
Eligibility
for
a
company
bonus
program
based
in
part
on
organizational
and
individual
performance.
Healthcare
coverage:
Medical,
dental,
vision,
and
prescription
drug
benefits
for
eligible
employees.
Retirement
planning:
Access
to
an
employer-sponsored
401(k)
plan
and
pension
benefits,
subject
to
applicable
program
terms.
Paid
time
off:
Vacation
benefits
and
eligible
leave
programs
to
support
work-life
balance.
Financial
protection:
Life
insurance,
death
benefits,
and
other
eligible
financial
protection
programs.
Flexible
benefits:
Potential
access
to
healthcare
and
dependent-care
benefits,
including
applicable
flexible
spending
options.
Well-being
resources:
Employee
assistance
programs,
fitness
benefits,
and
employee
clubs
and
activities.
Remote
work:
A
full-time
remote
position
based
in
the
United
States.
Leadership
impact:
The
opportunity
to
shape
enterprise
security
strategy,
lead
established
security
teams,
and
drive
measurable
reductions
in
organizational
cyber
risk.
Inclusive
workplace:
Access
to
employee
resource
groups
and
a
workplace
committed
to
equal
opportunity,
diversity,
accessibility,
and
professional
development.