Cybersecurity Vulnerability Management Lead

Job Description

Position Summary

We are seeking a dedicated Cybersecurity Professional specializing in Vulnerability Management to build, operationalize, and govern an enterprise vulnerability management program from the ground up. This role focuses on bridging IT and Operational Technology (OT) environments, with an emphasis on industrial and utility infrastructure.

This is a pure cybersecurity role focused on vulnerability discovery, risk prioritization, dashboarding, and remediation workflows. The ideal candidate brings deep operational technology domain expertise and hands-on technical proficiency with Axonius (specifically the Exposure Management module) and Dragos .

Key Responsibilities

\n
• Program Development: Architect, implement, and run an end-to-end vulnerability management program encompassing both enterprise and OT/ICS environments.
\n
• Exposure Management & Dashboarding: Operationalize Axonius Exposure Management to aggregate asset intelligence, map attack surfaces, and build unified, executive- and operational-level vulnerability dashboards.
\n
• OT/ICS Vulnerability Operations: Leverage Dragos to passively monitor industrial networks, track asset inventories, evaluate ICS-specific CVEs, and apply risk-based prioritization.
\n
• Risk Prioritization & Remediation: Establish contextual risk scoring that accounts for operational constraints, uptime requirements, and safety protocols in industrial environments (e.g., compensating controls vs. active patching).
\n
• Cross-Functional Collaboration: Partner with operations, plant engineers, SCADA specialists, and IT stakeholders to drive vulnerability triage, remediation validation, and SLA tracking without causing operational downtime.
\n
• Metrics & Reporting: Define KPIs, track Mean Time to Remediate (MTTR), and deliver regular vulnerability posture reports to leadership.
\n

Candidate Qualifications

Must-Haves:

\n
• Cybersecurity Foundation: Proven track record in vulnerability management, cyber exposure reduction, and threat-informed risk analysis. (Note: This is a cybersecurity tooling and workflow role, not a network engineering or administration position).
\n
• Operational Technology (OT) Domain Expertise: Direct experience managing security risks within OT, ICS, SCADA, or industrial control environments. Background in the utilities sector (electric, water, gas, or energy) is strongly preferred.
\n
• Axonius Hands-on Experience: Direct, hands-on experience utilizing Axonius, with demonstrated ability to leverage the Axonius Exposure module for metrics and dashboard creation.
\n
• Dragos Familiarity: Working knowledge and operational experience with the Dragos platform for ICS/OT asset discovery and vulnerability monitoring.
\n
• Work Arrangement: Must reside within commuting distance of Stamford, CT , and be able to work on-site 3 days per week.
\n

Preferred Qualifications:

\n
• Familiarity with industrial frameworks and standards (e.g., NIST SP 800-82, IEC 62443, NERC CIP).
\n
• Experience formulating compensating control strategies for legacy or unpatchable field devices.
\n
• Relevant industry certifications (e.g., GICSP, GRID, CISSP, CEH, or vendor-specific Axonius/Dragos credentials).
\n