Senior Director - Security Posture & Exposure Management

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Senior Director – Security Posture & Exposure Management based in the United States. The Senior Director will lead enterprise-wide vulnerability management and security exposure reduction across complex technology environments. This strategic, hands-on leadership role is responsible for identifying security weaknesses, assessing their real-world risk, and ensuring timely remediation across cloud, on-premises infrastructure, applications, endpoints, and specialized environments. You will oversee multiple security functions, including vulnerability management, application security, offensive security, advanced vulnerability discovery, and exposure reporting. By combining deep technical expertise with organizational leadership, you will transform vulnerability scanning into a risk-based, data-driven security capability. Working closely with technology leaders, security operations, and risk management teams, you will strengthen accountability and improve the organization's overall security posture. This is an opportunity to shape enterprise security strategy, develop high-performing teams, and deliver measurable reductions in cyber risk. \n Accountabilities

Define enterprise vulnerability management strategy: Own the technical strategy, architecture, operating model, roadmap, and performance outcomes for end-to-end vulnerability management across cloud environments, on-premises infrastructure, applications, endpoints, and operational technology or laboratory systems.

Lead security teams and organizational development: Manage and develop leaders and teams across vulnerability management, application security, offensive security, advanced vulnerability discovery, finding validation, prioritization, and exposure reporting. Establish clear priorities, develop talent, and maintain accountability for results.

Oversee enterprise scanning and discovery: Direct the architecture and performance of the enterprise scanning environment, including asset coverage, scan health, authenticated and agent-based scanning, asset reconciliation, tooling selection, and integration with ticketing systems, configuration management databases, and reporting platforms.

Establish risk-based prioritization: Develop and enforce prioritization frameworks that incorporate vulnerability severity, exploitability, threat intelligence, asset criticality, and exposure context. Ensure findings are validated and resources are focused on the weaknesses that pose the greatest business risk.

Drive remediation and accountability: Establish remediation service-level agreements (SLAs), escalation procedures, exception processes, and clear ownership models. Work with technology owners and their leadership to accelerate remediation and demonstrate measurable improvements.

Oversee application and offensive security programs: Integrate application security findings into enterprise-wide vulnerability management, including static and dynamic application security testing and software composition analysis. Guide offensive security and advanced discovery activities, ensuring findings lead to systemic improvements rather than isolated fixes.

Manage exposure reporting and analytics: Own executive reporting, technology-owner scorecards, risk trends, remediation progress, and the underlying data pipelines and metrics. Ensure reporting is accurate, actionable, and suitable for executive decision-making and audit review.

Provide technical leadership and escalation: Serve as the senior technical authority for disputed findings, severity assessments, exploitability decisions, false positives, and risk exceptions. Evaluate scanning configurations and prioritization models, identify coverage gaps, and direct improvements.

Coordinate with security and technology stakeholders: Partner with security operations, incident response, threat intelligence, risk and compliance, internal audit, platform owners, and application teams to prioritize actively exploited vulnerabilities and incorporate lessons from security incidents.

Manage risk acceptance and mitigation: Document mitigation strategies and oversee risk acceptance when vulnerabilities cannot be fully eliminated, ensuring residual exposure is accurately communicated and approvals meet audit and governance requirements.

Oversee budgets and external partnerships: Manage departmental budgets, vendor relationships, contracts, and workforce planning, including external and offshore resources, to ensure effective delivery and operational scalability.

Requirements

High school diploma or equivalent, with at least 4 years of experience in cybersecurity, information technology, or a related field.

At least 10 years of hands-on professional cybersecurity experience, primarily in vulnerability management, security operations, offensive security, or a closely related discipline.

At least 5 years of experience leading a security function, with a minimum of 3 years managing people leaders.

Extensive practical experience with vulnerability management platforms, security scanning, exploitability analysis, attack surface management, and remediation operations across hybrid cloud and on-premises environments. Experience with operational technology or regulated laboratory environments is an advantage.

Proven ability to lead enterprise-scale security organizations, manage multiple teams through their leaders, establish strategic priorities, and deliver measurable improvements in security performance.

Strong understanding of application security practices, including static and dynamic application security testing (SAST/DAST), software composition analysis, and secure software development, with the ability to integrate application findings into enterprise vulnerability management.

Demonstrated expertise in developing risk-based prioritization models that technology teams trust and use to guide remediation decisions.

Experience implementing remediation SLAs, escalation mechanisms, and accountability frameworks that improve remediation speed and outcomes.

Working knowledge of offensive security and red-team practices, including the ability to assess findings, guide testing priorities, and translate discoveries into sustainable security improvements.

Experience designing or modernizing security tooling architectures, automation capabilities, integrations, and data pipelines to improve coverage, reliability, and operational efficiency.

Strong analytical and data management skills, including defining meaningful metrics, validating data quality, identifying coverage gaps, and communicating exposure trends and risk decisions clearly.

Excellent leadership, communication, and stakeholder management skills, with the ability to influence senior technology leaders and drive action beyond direct reporting relationships.

Strong judgment and problem-solving capabilities, particularly when evaluating vulnerability findings, balancing competing risks, and allocating remediation resources effectively.

A bachelor's degree in cybersecurity, computer science, information technology, or a related field is preferred.

Benefits

Annual salary: $159,000–$257,400, depending on qualifications, experience, and geographic location.

Performance incentives: Eligibility for a company bonus program based in part on organizational and individual performance.

Healthcare coverage: Medical, dental, vision, and prescription drug benefits for eligible employees.

Retirement planning: Access to an employer-sponsored 401(k) plan and pension benefits, subject to applicable program terms.

Paid time off: Vacation benefits and eligible leave programs to support work-life balance.

Financial protection: Life insurance, death benefits, and other eligible financial protection programs.

Flexible benefits: Potential access to healthcare and dependent-care benefits, including applicable flexible spending options.

Well-being resources: Employee assistance programs, fitness benefits, and employee clubs and activities.

Remote work: A full-time remote position based in the United States.

Leadership impact: The opportunity to shape enterprise security strategy, lead established security teams, and drive measurable reductions in organizational cyber risk.

Inclusive workplace: Access to employee resource groups and a workplace committed to equal opportunity, diversity, accessibility, and professional development.

\n

How Jobgether works: We use an

AI-powered matching process

to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team. We appreciate your interest and wish you the best! Why Apply Through Jobgether? Data Privacy Notice:

By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time. #LI-CL1