Senior Vice President, Exposure Management / Vulnerability Management

Position: Senior Vice President, Exposure Management / Vulnerability Management

Location: Hybrid / NYC — 4–5 days on-site per week (no relocation)

Employment Type: Full-time

Interview: Video

Note: Must work off-hours 1–2 days/week in the first few months to overlap with Singaporean teams

Role Overview

A leading global financial services firm is seeking a Senior Vice President, Exposure Management to serve as the Global Head of Exposure Management within its Cybersecurity Assurance & Defence (CSAD) team. This senior leadership role owns the strategy, roadmap, and enterprise-wide execution of the firm's threat exposure and vulnerability management program.

The ideal candidate is a deeply experienced security practitioner (15+ years) with a background spanning Application Security, Vulnerability Management, Red Team, and Penetration Testing, who can operate as a control owner and primary interface for internal and external audit while influencing stakeholders across technology and business — including trading desks.

Key Responsibilities

• Define and execute the exposure and vulnerability management strategy, aligned with enterprise risk appetite, regulatory requirements, and business objectives.
• Establish and mature a forward-looking, risk-based threat exposure management program at enterprise scale, integrating threat intelligence, security analytics, and automation.
• Maintain continuous visibility of the enterprise attack surface — external, cloud, on-premises, hybrid, and identity-based — moving from reactive scanning to proactive exposure reduction.
• Lead and govern scanning and assessment activities, ensuring consistent standards, accuracy, timely mitigation, and transparent reporting.
• Drive risk-based prioritization using threat context, exploitability, attack-path analysis, and business criticality.
• Employ exposure validation techniques — attack path modelling, breach and attack simulation, red team exercises, and penetration testing — to confirm real-world risk and measure control effectiveness.
• Serve as a control owner: drive threat prioritization, root cause analysis, and cross-team remediation to prevent recurrence.
• Act as the primary interface for internal and external audit and manage security programs for the business.
• Develop, update, and manage exposure, vulnerability, and security patch management standards.
• Define and track KPIs, KRIs, and program maturity metrics.
• Communicate complex technical exposures to senior management and business stakeholders to drive informed, risk-based decisions.
• Build and lead a high-performing team; develop and manage budgets with a global mindset.
• Stay abreast of global cybersecurity trends, emerging vulnerabilities, exploits, and regulatory developments.

Required Qualifications

• 15+ years in cybersecurity, with at least 7 years in senior leadership overseeing exposure and vulnerability management operations.
• Proven experience establishing or maturing a threat exposure management (or equivalent risk-based) program at enterprise scale.
• Background across Application Security, Vulnerability Management, Red Team, and Penetration Testing.
• Expertise across the exposure management lifecycle: attack surface management, vulnerability management tools, exposure assessment and prioritization, penetration testing, continuoautomated validation (e.g., BAS), threat intelligence, and AI/automation.
• Strong grasp of risk-based prioritization, attack-path analysis, and exposure validation.
• Deep understanding of regulatory environments, financial services operations, and technology risk management.
• Proven track record of leading large-scale cybersecurity programs.
• Excellent communication and stakeholder management skills, with the ability to influence at all levels — technical teams, senior management, and business/trading stakeholders.
• Global mindset and financial literacy for budget development.
• Degree in Computer Science, Information Security, or related field preferred; certifications (SANS, OFFSEC, CISSP, CISM, CRISC, etc.) desirable.