Vulnerability Management Manager

The Vulnerability Management Manager is a key leader within the information security organization, responsible for driving the firm’s enterprise-wide vulnerability management strategy. This role oversees the continuous identification, assessment, prioritization, and remediation of vulnerabilities across operating systems, applications, cloud platforms, and infrastructure. Working closely with security, infrastructure, and application teams, the manager ensures remediation efforts align with the firm’s risk tolerance, regulatory requirements, and industry best practices. Key Responsibilities Lead the end‑to‑end vulnerability management lifecycle, including assessment, prioritization, and remediation tracking across endpoints, servers, applications, and cloud environments. Apply risk‑based frameworks (CVSS, EPSS, CISA KEV), threat intelligence, and business context to determine vulnerability criticality and guide remediation decisions. Develop and govern patching schedules, phased rollout plans, and maintenance windows that balance operational needs with security and compliance requirements. Ensure timely patching of desktops, servers, and applications by coordinating with product owners and patching teams, enforcing remediation SLAs, and managing exception and risk‑acceptance processes. Correlate vulnerability scan results with patch deployment data to identify coverage gaps, measure compliance, and elevate high‑risk issues or systemic deficiencies. Lead emergency and out‑of‑band patching efforts for actively exploited or critical vulnerabilities, ensuring rapid response with minimal business disruption. Provide advanced troubleshooting support for complex vulnerabilities, collaborating with system administrators, application owners, and engineering teams to implement remediation or compensating controls. Enforce patching and vulnerability compliance standards aligned to NIST, CIS Controls, and internal security policies. Maintain documentation for vulnerability management processes, baselines, exception handling, and reporting to support audits and continuous improvement. Deliver reporting on vulnerability trends, program KPIs, and risk exposure for both technical stakeholders and executive leadership. Requirements & Qualifications Bachelor’s degree in IT, Computer Science, or related field, or equivalent experience. 5–7 years of experience in vulnerability management, patch management, or infrastructure security within medium to large enterprise environments. Strong understanding of vulnerability and patch management principles and hands‑on experience with tools such as Tenable, Qualys, or Rapid7. Familiarity with endpoint patching platforms including WSUS, SCCM, and Intune. Demonstrated analytical, communication, and problem‑solving skills with the ability to manage multiple priorities. Experience supporting audits, assessments, and automated vulnerability management workflows, including SLA tracking and compliance reporting. Working knowledge of security frameworks such as NIST CSF or ISO 27001. Ability to obtain and maintain a Secret clearance; U.S. citizenship required. Security certifications (CISSP, CISM, CISA, or similar) are a plus. #J-18808-Ljbffr Green Key Resources