Head of Vulnerability Management (Global Banking is required)

The Head of Vulnerability Management is responsible for leading enterprise-wide efforts to detect, assess, prioritize, and remediate vulnerabilities across infrastructure, applications, and cloud environments. This role will design and execute a risk-based vulnerability management program aligned with industry best practices and regulatory requirements. The ideal candidate will work across multiple teams to improve the organization's security posture, guide remediation efforts, and provide executive-level visibility into risk exposure. The position demands strong leadership, technical expertise, and experience in regulated environments.

Key Responsibilities:

Vulnerability Management Leadership

• Develop and manage a comprehensive vulnerability management strategy aligned with security frameworks and compliance standards.

• Create and maintain policies, procedures, and standards for vulnerability identification and remediation.

• Deliver regular executive reports on risk posture, vulnerability trends, and remediation progress.

• Continuously mature the program through automation and process improvement.

Scanning & Assessment

• Oversee the use of enterprise vulnerability scanning tools across on-premises and cloud environments.

• Ensure consistent asset discovery and scanning coverage.

• Prioritize vulnerabilities based on business risk, exploitability, and regulatory impact.

• Analyze and validate scan results to support timely and accurate decision-making.

Remediation & Risk Mitigation

• Partner with IT, development, and infrastructure teams to drive timely remediation.

• Define KPIs and metrics to track remediation effectiveness.

• Provide recommendations for compensating controls and risk acceptance when applicable.

• Lead escalation processes for critical vulnerabilities.

Threat Intelligence & Prioritization

• Incorporate threat intelligence into vulnerability analysis to prioritize based on real-world threats.

• Stay informed of zero-day vulnerabilities and align responses accordingly.

• Collaborate with incident response teams to assess exploited vulnerabilities.

• Use frameworks like MITRE ATT&CK for advanced threat mapping.

Compliance & Governance

• Ensure all activities meet regulatory requirements, including FFIEC, NYDFS, and other industry-specific standards.

• Support audit processes by providing evidence of program controls and activities.

• Maintain detailed documentation for compliance and risk reporting.

• Align remediation actions with compliance timelines and objectives.

Tooling & Automation

• Manage and optimize tools such as Qualys, Tenable, or Rapid7.

• Automate detection and remediation workflows through scripting and orchestration platforms.

• Evaluate new technologies to enhance vulnerability management capabilities.

• Work closely with DevOps teams to embed security into CI/CD and DevSecOps pipelines.

Stakeholder Engagement & Training

• Serve as the primary point of contact for vulnerability-related issues across business and IT functions.

• Provide executive briefings and risk updates.

• Train teams on secure coding practices and vulnerability remediation procedures.

• Foster a culture of security awareness and proactive risk management.

Core Competencies:

Experience:

• 10+ years of experience in cybersecurity or related fields.

• Minimum 3 years leading vulnerability management efforts.

• Hands-on experience with vulnerability tools (e.g., Qualys, Tenable, Rapid7).

• Background in highly regulated environments.

Technical Skills:

• Proficient in scripting (Python, PowerShell, Bash).

• Strong knowledge of network, cloud (AWS, Azure, Google Cloud Platform), and application security.

• Familiarity with patch management and hardening techniques.

• Skilled in translating technical risks into business terms.

Leadership & Communication:

• Proven track record of managing cross-functional teams and driving remediation initiatives.

• Strong communication skills, capable of engaging technical and non-technical stakeholders.

• Strategic mindset with the ability to align security objectives with business priorities.

Qualifications:

• Bachelor's degree in Cybersecurity, Information Technology, or related field required.

• Advanced degree (MBA, MS) preferred.

• Industry certifications such as CISSP, CISM, or GIAC strongly preferred.