Associate Director, Vulnerability Management

The Associate Director, Vulnerability Management is responsible for developing and managing a risk based cyber threat and vulnerability management program and will lead a team that provides continuous vulnerability scanning, configuration monitoring, testing, patch management, and reporting. They will collaborate with IT teams and business process owners to ensure gaps are quickly remediated.

The ideal candidate is a technical, hands-on leader with the ability to drive consensus and collaboration among many diverse teams, individuals, and business stakeholders to achieve desired results.  They can explain technical concepts in non-technical terms and have excellent interpersonal, leadership, presentation, and collaborative skills. The candidate must be detail-oriented with the ability to adapt rapidly to new challenges, think creatively and holistically, and quickly resolve unforeseen issues.

Responsibilities

• Establish, update, and maintain a vulnerability management program based on industry standards & best practices that includes asset discovery, vulnerability scanning, secure configuration monitoring, and remediation or mitigation activity

• Deliver continuous scanning, identification, and reporting of internal and external attack surface throughout on-prem and cloud-based environments across Firm products, technologies, and networks

• Recommend, socialize, and gain consensus on minimum patching and vulnerability management standards and policies across Firm IT teams and business stakeholders

• Lead vulnerability response efforts to address imminent threats and zero-day vulnerabilities 

• Monitor vulnerability remediation progress and partner with IT teams to provide recommendations for efficient risk remediation or mitigation 

• Provide regular reporting on the current state of vulnerabilities and configurations throughout the entire environment including acquisitions

• Monitor, mitigate, and report on additional threats, including supply chain attacks, vulnerabilities in code, unencrypted protocols, digital footprint issues, and other cybersecurity control gaps

• Manage internal and external penetration testing, red team activities, active port audits, and software audits to identify EOL hardware and software, insecure legacy applications, and otherwise unsafe or unauthorized software

• Manage a portfolio of scanning, vulnerability management, breach simulation, and reporting tools and ensure that security agents and vulnerability monitoring tools are deployed correctly and operating properly

• Develop cyber health scoring algorithms and measurement criteria, and build consumable reporting for technical and non-technical stakeholders, Firm leadership, and external clients

• Responsible for staying informed of industry leading vulnerability and software security vendors, latest threats & risks, and continuously updating program based on business priorities and available cyber threat intelligence

Education

• Bachelor’s degree in information security, IT, related discipline, or equivalent experience required

• Professional certifications such as CISSP, CCSP, CISM, or similar

Skills and Experience

• 15+ years of experience in an IT or Information Security role, with at least 5 years managing or leading an Information Security vulnerability management function

• Demonstrated success in program development, project execution, and operational delivery

• Demonstrated knowledge and expertise in vulnerability assessment, risk management, and cybersecurity frameworks such as NIST, CIS, and OWASP

• Expert familiarity with the Mitre attack framework & CVE/CVSS scoring system

• Strong technical knowledge of vulnerability scanning and attack surface management tools (e.g., Qualys, Nexpose, Metasploit, AttackIQ, Shodan, etc.)

• Working knowledge of cloud computing systems (SaaS, PaaS, and IaaS), containers, cloud orchestration

• Experience working in a global organization and broad knowledge of security domains, technology risk management concepts, and a working knowledge of security and risk frameworks

• Knowledge of core networking concepts including TCP/IP, firewalls, and network security products

• Knowledge of common application architectures, design, protocols, and agile deployment methodology and best practices

• Ability to create and execute a clear strategic vision for vulnerability management that supports and enables businesses functions

• Ability to manage multiple concurrent objectives and activities, and make effective judgments in prioritizing and time allocation

• Must be able to e