Senior Director, Exposure & Vulnerability Management

Description

WTW is seeking a Senior Director of Exposure & Vulnerability Management to lead WTW's vulnerability management security program. Reporting to the Global Head of Attack Surface Management, this leader owns the strategy, execution and evolution of enterprise exposure management capabilities spanning vulnerability operations, exposure validation, aligning with secure development (SAST/SCA/DAST) and risk intelligence, with a relentless focus on prioritization, business impact, mitigation strategies and measurable risk reduction.

The role partners closely with Corporate & Business Technology, Cloud Operations, Product, Platform Engineering, Risk Management, Privacy & Compliance, Managed Service Providers and Internal Audit stakeholders to ensure security findings are translated into actionable insight, aligned remediation priorities and demonstrably improved security outcomes across the enterprise. As a senior member of the Attack Surface Management leadership team, the Senior Director also acts as a strategic deputy to the Global Head, contributing to program direction, investment decisions, steering committee deliverables, and executive-level reporting.

The Role

As WTW continues to scale its digital platforms, client services and cloud estate, managing cyber risk requires more than identifying vulnerabilities. It requires understanding exposure, exploitability, reachability and business impact across infrastructure, cloud, identity, applications and the software supply chain.

The Exposure & Vulnerability Management function is accountable for transforming how security risk is identified, contextualized, validated and addressed across the enterprise. This includes shifting to a unified, continuous exposure management model that is aligned to Continuous Threat Exposure Management (CTEM) principles and built on an accurate, authoritative view of WTW's assets. The Senior Director will lead multi-disciplinary global teams while driving modernization across data, tooling, metrics, governance and engagement models.

The Responsibilities

Exposure Management Strategy & Program Leadership

• Define and own WTW's enterprise exposure & vulnerability management strategy and a multi-year roadmap that aligns infrastructure, cloud, application, identity and software supply chain risk into a unified risk view.
• Operationalize a continuous exposure & vulnerability management lifecycle (scoping, discovery, prioritization, validation and mobilization) aligned to CTEM principles.
• Track vulnerabilities via risk-based prioritization grounded in exploitability, threat intelligence, asset criticality, exposure and business impact.
• Establish clear ownership models, accountability and engagement patterns with technology and engineering teams to drive timely and effective remediation.
• Own the annual operating plan and budget for exposure & vulnerability management, building business cases for investment and demonstrating return in terms of risk reduction.

Discovery, Scoping & Asset Context

• Ensure continuous, comprehensive discovery of exposures across on-premises, cloud technologies, endpoints, IoT, SaaS and internet-facing attack surfaces.
• Partner with the Asset Management team to ensure exposure data is anchored to an accurate, authoritative asset inventory (CMDB), including ownership, business service mapping and criticality tiering.
• Ensure exposure coverage includes misconfigurations, cloud posture, identity and access weaknesses, external attack surface and unmanaged or shadow assets.

Risk-Based Prioritization & Exposure Validation

• Own and continuously refine WTW's risk-based vulnerability scoring and prioritization model, incorporating exploit prediction (e.g. EPSS), known-exploited intelligence (e.g. CISA KEV), threat intelligence, compensating controls and business context.
• Establish exposure validation capabilities, including attack path analysis, breach and attack simulation, and coordination with penetration testing and red team functions, to confirm real-world exploitability.
• Define and maintain risk-tiered remediation SLAs that differentiate by exposure, asset type and business criticality.

Vulnerability Operations & Remediation Mobilization

• Lead global teams responsible for vulnerability operations, ensuring consistent, scalable execution of discovery, validation, prioritization, tracking and closure across technology domains.
• Drive remediation mobilization through integrated workflows, clear hand-offs to owning teams and escalation paths for overdue or high-risk exposures.
• Lead WTW's response to critical and emerging vulnerabilities (e.g. zero-days and widely exploited flaws), coordinating rapid impact assessment, executive communication and accelerated remediation with Security Operations, Incident Response and Technology.
• Maintain availability for critical and emerging vulnerability events (e.g. zero-days), including participation in an on‑call rotation or escalation structure to ensure rapid impact assessment and response outside of standard business hours.
• Own the vulnerability risk exception and acceptance process, ensuring exceptions are risk‑assessed, time‑bound, approved at the appropriate level and tracked to resolution.

Secure Development & Software Supply Chain (Partner to Application Security)

• Partner with Application Security and Business Technology leadership to embed SAST, DAST and SCA coverage and the broader application security toolchain (e.g., secrets detection, container and infrastructure‑as‑code scanning) — contributing risk‑based prioritization methodology and ensuring application findings feed into the same risk‑ranked queue as infrastructure and cloud exposures, rather than owning the toolchain itself.
• Support Application Security's efforts to embed security earlier in the SDLC by aligning exposure & vulnerability management's remediation workflow, SLAs, and reporting with their developer‑friendly tooling and pipeline guardrails — extending consistent tracking and accountability to application‑layer findings without taking on pipeline ownership.
• Collaborate with Application Security, Business Technology, and GRC to strengthen software supply chain risk management — including open‑source governance and SBOM practices — providing exposure‑management visibility, prioritization, and reporting rather than owning the program.

Governance, Regulatory & Risk Alignment

• Own the policies, standards and procedures governing vulnerability and exposure management, ensuring they are current, enforceable and consistently applied.
• Ensure the program meets regulatory and contractual obligations across WTW's operating jurisdictions, including DORA, NYDFS Part 500, GDPR and relevant client and industry requirements.
• Serve as the accountable lead for exposure & vulnerability management in engagements with regulators, Internal Audit, external auditors and client security assessments, and own remediation of related findings.
• Partner with Enterprise Risk and the second line to align exposure metrics with WTW's cyber risk appetite, key risk indicators and risk register.
• Assess and govern exposure risk introduced through acquisitions, divestitures and third‑party or managed service providers.

Data, Metrics & Risk Intelligence

• Build and mature exposure‑focused metrics and KRIs that enable leadership to understand risk posture, trends, remediation effectiveness and SLA performance.
• Partner with data and analytics teams to leverage security telemetry, automation and correlation across multiple data sources.
• Translate technical findings into clear, decision‑ready insight for the CISO, executive leadership, risk committees and, where required, the Board.

Technology, Automation & Vendor Management

• Drive modernization of exposure & vulnerability management tooling, workflows and integrations, including consolidation and rationalization of overlapping tools.
• Identify and deliver opportunities for automation, orchestration and responsible use of AI to scale prioritization, triage and remediation.
• Partner with Product, Business Technology, Engineering, Cloud Operations, and Architecture teams to influence platform capabilities and security‑by‑design practices.
• Own vendor and managed service relationships for exposure & vulnerability management, including selection, contract governance and performance management.

Leadership, Talent & Stakeholder Engagement

• Lead, coach and develop high‑performing teams across multiple disciplines and geographies, including managers of managers.
• Design the organization, roles and career paths for the function; build succession and a strong bench of future leaders.
• Foster a culture of collaboration, accountability and continuous improvement, breaking down silos between vulnerability, asset and application security teams.
• Serve as a trusted advisor to Technology, Security and Risk leadership on exposure trends and remediation priorities.
• Influence cross‑functional stakeholders without direct authority in a complex, matrixed, global environment.

Qualifications

The Qualifications

• 10+ years in information security, technology risk or IT, including 7+ years leading enterprise‑scale vulnerability, exposure or security programs in a large, complex, global organization.
• Proven experience leading multi‑disciplinary, geographically distributed teams, including leaders of leaders.
• Deep understanding of vulnerability management, application security (SAST/SCA), cloud security and modern software delivery environments.
• Hands‑on familiarity with risk‑based prioritization approaches, threat intelligence, and exposure validation techniques.
• Demonstrated ability to move program from operational execution to strategic, outcome‑driven models.
• Strong data‑driven mindset, with experience using metrics and analytics to influence decisions and behavior.
• Track record of leading transformation initiatives across people, process and technology, including tool rationalization and vendor management.
• Experience operating in a regulated industry (financial services, insurance or similar) and engaging with regulators and auditors.
• Comfortable operating at both strategic and execution levels, translating vision into measurable results.
• Exceptional communication skills, with the ability to convey complex technical risk in business‑relevant terms to executive and Board audiences.

Preferred

• Experience in Cloud computing environments and with ServiceNow‑based or equivalent remediation workflows.
• Experience implementing a CTEM or equivalent continuous exposure management model.
• Familiarity with frameworks such as NIST CSF, ISO 27001, CIS Controls and FAIR or other risk quantification approaches.
• Relevant certifications such as CISSP, CISM, CRISC or equivalent.
• Bachelor's degree in Computer Science, Information Security or a related field, or equivalent experience.

Note: Employment‑based non‑immigrant visa sponsorship and/or assistance is not offered for this specific job opportunity.

This position will remain posted for a minimum of three business days from the date posted or until sufficient/appropriate candidate slate has been identified.

Compensation and Benefits - US locations only

Base salary range and benefits information for this position are being included in accordance with requirements of various state/local pay transparency legislation. Please note that base salaries may vary for different individuals in the same role based on several factors, including but not limited to location of the role, individual competencies, education/professional certifications, qualifications/experience, performance in the role and potential for revenue generation.

Compensation

The base salary compensation range being offered for this role is $180,000-$240,000 USDper year.

This role is also eligible for an annual short‑term incentive bonus.

Company Benefits

WTW provides a competitive benefit package which includes the following (eligibility requirements apply).

• Health and Welfare Benefits: Medical (including prescription coverage), Dental, Vision, Health Savings Account, Commuter Account, Health Care and Dependent Care Flexible Spending Accounts, Group Accident, Group Critical Illness, Life Insurance, AD&D, Group Legal, Identify Theft Protection, Wellbeing Program and Work/Life Resources (including Employee Assistance Program)
• Leave Benefits: Paid Holidays, Annual Paid Time Off (includes paid state/local paid leave where required), Short‑Term Disability, Long‑Term Disability, Other Leaves (e.g., Bereavement, FMLA, ADA, Jury Duty, Military Leave, and Parental and Adoption Leave), Paid Time Off (Washington State only)
• Retirement Benefits: Contributory Pension Plan and Savings Plan (401k).

Pursuant to the San Francisco Fair Chance Ordinance and Los Angeles County Fair Chance Ordinance for Employers, we will consider for employment qualified applicants with arrest and conviction records.

EOE, including disability/vets