Vulnerability Program Manager

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Vulnerability Program Manager based in the United States.

This role owns the end-to-end delivery of vulnerability management and patching across a diverse client portfolio.
You will establish consistent standards, processes, reporting, and accountability across multiple environments and delivery teams.
The position combines hands-on cybersecurity operations with program leadership, client engagement, and continuous improvement.
You will work directly with vulnerability management and patching tools while coordinating remediation across technical teams and client stakeholders.
Your work will help organizations reduce cyber risk, meet compliance expectations, and maintain stronger security postures.
The environment is collaborative and fast-paced, requiring strong influence and communication across teams that may not report directly to you.
This is an opportunity to build and mature a scalable security service while making a measurable impact on client outcomes.

Accountabilities:

• Own the end-to-end vulnerability management and patching program, including asset discovery, scanning, risk-based prioritization, remediation tracking, verification, exception management, and reporting.
• Define and document standardized service processes, including scan frequency, patching cadence, severity-based remediation targets, risk acceptance procedures, and emergency response criteria.
• Establish clear roles and responsibilities across vulnerability analysts, security engineering, service desk teams, and client stakeholders.
• Design ticket types, templates, workflows, and reporting processes in PSA tooling to ensure vulnerability and patching activities are consistently documented.
• Run recurring vulnerability management reviews for assigned clients, maintain prioritized remediation backlogs, and proactively escalate stalled or aging findings.
• Coordinate remediation across internal delivery teams and client personnel, taking change windows, maintenance periods, and operational constraints into account.
• Manage exclusions, suppressions, and risk acceptances with appropriate documentation, ownership, rationale, and review dates.
• Act as the escalation point for urgent vulnerability response, including zero-day vulnerabilities and actively exploited threats requiring out-of-cycle remediation.
• Own client-facing vulnerability reporting, including recurring review materials, aging and trend analysis, and executive-level summaries.
• Present risk, remediation progress, and program status to technical and non-technical client stakeholders while clearly communicating responsibilities, dependencies, and required actions.
• Support audits and compliance requirements involving frameworks such as CMMC, PCI DSS, SOC 2, HIPAA, and NCUA examinations.
• Partner with client success and account teams during onboarding, escalations, renewals, and other client engagements.
• Maintain the operational health of vulnerability management tooling, including scanner coverage, credentialed scanning, agent deployment, and asset inventory accuracy.
• Collaborate with security engineering to integrate scanning, ticketing, and patching platforms and reduce manual reporting effort.
• Identify data-quality issues such as stale assets, duplicate records, and unmanaged endpoints that can affect vulnerability reporting.
• Define and track metrics including remediation SLA attainment, vulnerability aging, patch compliance, scan coverage, and recurring findings.
• Use program data to identify systemic issues and drive improvements to processes, tooling, automation, and service delivery.
• Train and mentor vulnerability analysts and other delivery personnel on standardized processes and contribute to the development of vulnerability management service offerings.

Requirements:

• Demonstrated experience managing vulnerability management and patching programs across multiple clients or environments, preferably within an MSP or MSSP.
• Hands-on experience with vulnerability management and patching platforms such as InsightVM, ConnectSecure, NinjaOne, Datto RMM, or equivalent technologies.
• Working knowledge of PSA and workflow platforms, with HaloPSA experience preferred, including ticket configuration and reporting.
• Practical understanding of risk-based vulnerability prioritization using CVSS, exploit intelligence, asset criticality, and business context rather than relying solely on severity scores.
• Familiarity with cybersecurity and compliance requirements associated with CMMC, PCI DSS, SOC 2, HIPAA, and NCUA examinations.
• Strong written and verbal communication skills, including experience leading client meetings and translating technical findings for non-technical audiences.
• Ability to coordinate and influence work across multiple teams without direct reporting authority.
• Strong organizational, analytical, and problem-solving skills, with the ability to manage competing priorities and maintain consistent follow-through.
• Relevant certifications such as Security+, GIAC, CISSP, or vendor-specific credentials are preferred but not required.
• Comfortable working directly in security tooling and taking a hands-on approach rather than managing program activities solely from a strategic or administrative level.

Benefits:

• Salary: $75,000–$100,000 annually.
• Full-time, exempt position.
• Standard business hours with flexibility around month-end close.
• Innovative cybersecurity and IT solutions supporting financial and regulated industries.
• Opportunities for professional growth and hands-on exposure to enterprise-level security operations and program execution.
• Collaborative, people-focused environment that values learning, structure, and shared success.
• Occasional travel opportunities for client engagement, team integration, and offsite activities.

How Jobgether works:

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.