Vulnerability Management Manager

About the Role

The Systems Manager, Vulnerability Management leads the Vulnerability Management team, driving measurable risk reduction across systems, cloud, applications, and operational technology (OT). Reporting to the Director, Cybersecurity Operations, this role partners closely with engineering, platform, operations, application security, cloud teams, and OT stakeholders to strengthen cloud security, advance application security, and build OT security vulnerability management from scratch. The role modernizes the vulnerability management program towards Continuous Threat Exposure Management (CTEM), ensuring rapid response to emerging critical vulnerabilities and risks.

Responsibilities

• Manage a team of about 9, coach performance, and build capabilities through hiring, skills plans, and targeted training.
• Provide clear updates to leadership and partner teams on project status, emerging issues, and remediation progress for high-severity items.
• Evolve beyond vulnerability patching by connecting vulnerabilities to exposure and threat context.
• Lead end-to-end intake, triage, prioritization, and remediation coordination for system-wide vulnerabilities.
• Identify and drive automation opportunities across scan orchestration, remediation ticketing, SLA tracking, and CI/CD pipeline integration.
• Lead end-to-end tracking, risk assessment, and escalation for emerging critical vulnerabilities, including managing risk exceptions and compensating controls.
• Partner with cloud, platform, and engineering stakeholders to reduce cloud risk misconfigurations and triage findings by business impact, exploitability, and exposure.
• Work with application and engineering teams to prevent vulnerable code and insecure configurations earlier in the lifecycle.
• Drive effective Web Application Firewall operations, including rule tuning, validation, and quality improvements.
• Coordinate response to runtime risks and findings discovered during execution.
• Stand up OT intake, scope, asset coverage, remediation paths, and verification.
• Train internal partners on OT finding prioritization and handling.

Qualifications

Required Education/Experience

• Bachelor's Degree and 8 years of relevant work experience.
• Master's Degree and 6 years of relevant work experience.

Preferred Education/Experience

• Master's Degree in IT, computer science, business administration, engineering, or related field, and 6 years of relevant work experience.

Relevant Work Experience

• 6+ years in vulnerability management, security operations, application security, system security, or related field, with proven ownership of triage and remediation workflows.
• Proven people leadership experience, including coaching, performance management, hiring, and skills development for technical teams.
• Strong cloud security fundamentals, especially reducing critical and high-risk resource misconfigurations.
• Strong application security fundamentals, including shift left and runtime risk management.
• Experience leading response for critical vulnerabilities and urgent events, including zero-day response and secrets leakage triage.
• Experience tracking vulnerability and remediation metrics and building dashboards to measure SLA performance and risk reduction.
• Ability to turn security strategy into measurable operations, including metrics and leadership reporting.
• Experience standing up new programs with clear scope, intake, and success criteria.

Preferred Skills/Experience

• Experience with CTEM or equivalent exposure management models.
• Practical WAF experience, including rule tuning and validation.
• OT environment experience or ability to build OT vulnerability management capability.
• Experience applying vulnerability management to regulatory requirements (e.g., NERC CIP).

Certifications

• CISSP, CISM, GIAC, or equivalent required.
• Project Management Professional (PMP) or related training is a plus.

Physical Demands

• Ability to sit or stand for extended periods while using a computer or phone.
• Ability to read small print and symbols.
• Willingness to work non-business hours during emergencies and travel within company service territory.