Senior Vice President, Exposure Management / Vulnerability Management

Position: Senior Vice President, Exposure Management / Vulnerability Management

Location: Hybrid / NYC — 4–5 days on-site per week (no relocation)

Employment Type: Full-time

Interview: Video

Note: Must work off-hours 1–2 days/week in the first few months to overlap with Singaporean teams 

Role Overview

A leading global financial services firm is seeking a Senior Vice President, Exposure Management to serve as the Global Head of Exposure Management within its Cybersecurity Assurance & Defence (CSAD) team. This senior leadership role owns the strategy, roadmap, and enterprise-wide execution of the firm's threat exposure and vulnerability management program.

The ideal candidate is a deeply experienced security practitioner (15+ years) with a background spanning Application Security, Vulnerability Management, Red Team, and Penetration Testing, who can operate as a control owner and primary interface for internal and external audit while influencing stakeholders across technology and business — including trading desks.

Key Responsibilities

·         Define and execute the exposure and vulnerability management strategy, aligned with enterprise risk appetite, regulatory requirements, and business objectives.

·         Establish and mature a forward-looking, risk-based threat exposure management program at enterprise scale, integrating threat intelligence, security analytics, and automation.

·         Maintain continuous visibility of the enterprise attack surface — external, cloud, on-premises, hybrid, and identity-based — moving from reactive scanning to proactive exposure reduction.

·         Lead and govern scanning and assessment activities, ensuring consistent standards, accuracy, timely mitigation, and transparent reporting.

·         Drive risk-based prioritization using threat context, exploitability, attack-path analysis, and business criticality.

·         Employ exposure validation techniques — attack path modelling, breach and attack simulation, red team exercises, and penetration testing — to confirm real-world risk and measure control effectiveness.

·         Serve as a control owner: drive threat prioritization, root cause analysis, and cross-team remediation to prevent recurrence.

·         Act as the primary interface for internal and external audit and manage security programs for the business.

·         Develop, update, and manage exposure, vulnerability, and security patch management standards.

·         Define and track KPIs, KRIs, and program maturity metrics.

·         Communicate complex technical exposures to senior management and business stakeholders to drive informed, risk-based decisions.

·         Build and lead a high-performing team; develop and manage budgets with a global mindset.

·         Stay abreast of global cybersecurity trends, emerging vulnerabilities, exploits, and regulatory developments.

Required Qualifications

·         15+ years in cybersecurity, with at least 7 years in senior leadership overseeing exposure and vulnerability management operations.

·         Proven experience establishing or maturing a threat exposure management (or equivalent risk-based) program at enterprise scale.

·         Background across Application Security, Vulnerability Management, Red Team, and Penetration Testing.

·         Expertise across the exposure management lifecycle: attack surface management, vulnerability management tools, exposure assessment and prioritization, penetration testing, continuoautomated validation (e.g., BAS), threat intelligence, and AI/automation.

·         Strong grasp of risk-based prioritization, attack-path analysis, and exposure validation.

·         Deep understanding of regulatory environments, financial services operations, and technology risk management.

·         Proven track record of leading large-scale cybersecurity programs.

·         Excellent communication and stakeholder management skills, with the ability to influence at all levels — technical teams, senior management, and business/trading stakeholders.

·         Global mindset and financial literacy for budget development.

·         Degree in Computer Science, Information Security, or related field preferred; certifications (SANS, OFFSEC, CISSP, CISM, CRISC, etc.) desirable.