Senior Manager, Threat & Vulnerability Risk Management Program

Job Title:

Senior Manager, Threat & Vulnerability Risk Management Program

Location:

CityScape

What you'll do:

As a IT Manager IV - Cyber you'll serve as a Subject Matter Expert (SME) on the Cyber system processes and data structures that support multiple Cyber technology disciplines. In this role you'll manage and deliver multiple complex functional projects to maintain security posture in time on budget. Additionally, this role will collaborate with internal business partners to proactively address ongoing customer needs and ensure rapid resolution to open issues. In this role you will foster a collaborative environment with focus on continuous improvement and delivery of working Cyber software. As a IT Manager IV - Cyber you'll also participate in strategic and tactical planning to coordinate the delivery of Cyber products and services while also working to evaluate technology and set standards. You'll be accountable to proactively recommend improvements to established business processes while continuing to deliver high value in execution. You'll also create and deliver comprehensive project plans as well as remove any impediments, track overall project performance, specifically to analyze the successful completion of business short-term and long-term goals.

The Senior Manager, Threat and Vulnerability Management will be responsible for designing, implementing, and maturing a scalable and risk-based vulnerability management program. This role will be critical in managing vulnerabilities across hybrid environments (on-premises, cloud, containers, and CI/CD pipelines) while ensuring compliance with CIS Benchmarks and other security frameworks.

This role reports directly to the WAB Business Information Security Officer.

• Lead the strategic direction and execution of the TVM program, covering cloud, infrastructure, application, container, and endpoint environments.
• Implement and enforce CIS security baseline compliance across enterprise assets, including cloud workloads, servers, and endpoints.
• Integrate automated scanning and security controls into DevSecOps pipelines to detect and remediate vulnerabilities early in the development lifecycle.
• Work cross-functionally with Cloud Engineering, DevOps, Infrastructure, and IT to prioritize and remediate vulnerabilities based on business risk, exploitability, and regulatory requirements.
• Manage the use and optimization of enterprise vulnerability scanning and compliance tools.
• Monitor emerging threats, zero-day vulnerabilities, and misconfigurations, and lead remediation and communication efforts accordingly.
• Develop reporting and metrics that provide visibility into vulnerability trends, patch compliance, and CIS benchmark adherence for technical and executive audiences.
• Contribute to cloud security governance, including the design and enforcement of security guardrails, Infrastructure-as-code (IaC) reviews, and automated compliance checks.
• Ensure alignment with regulatory standards (e.g., FFIEC, GLBA, PCI-DSS, NIST 800-53, ISO 27001) and drive continuous improvement in control effectiveness.
• Lead and mentor a team of security analysts and engineers focused on vulnerability detection, analysis, and risk mitigation.

What you'll need:

• 8+ years of progressive experience in cybersecurity, with 3+ years in a leadership role focused on vulnerability or cloud security management.
• Bachelor’s degree in Information Security, Computer Science, Engineering, or related field (Master’s preferred).
• Advanced experience implementing CIS Benchmarks and maintaining security compliance across diverse platforms.
• Intermediate knowledge of general Financial Services or Banking is preferred.
• Intermediate knowledge of applicable regulatory and legal compliance obligations, rules and regulations, industry standards and practices.
• Advanced ability to analyze a variety of data and summarize findings in applicable reports or other communication mediums. Utilize data to identify areas of improvement and opportunities for growth by collaborating with business and tech leads.
• Deep understanding of cloud platforms (AWS, Azure, GCP) and their native security capabilities, particularly related to vulnerability scanning and configuration hardening.
• Hands-on experience integrating security into DevOps/CI-CD pipelines and managing containerized environments (e.g., Docker, Kubernetes).
• Familiarity with infrastructure-as-code (IaC) and automated policy enforcement (e.g., Terraform, CloudFormation, Open Policy Agent).
• Strong knowledge of vulnerability scoring systems (e.g., CVSS), threat intelligence, and patch management strategies.
• Excellent communication and leadership skills, with the ability to