Senior Vice President, Exposure Management / Vulnerability Management

Position: Senior Vice President, Exposure Management / Vulnerability Management

Location: Hybrid / NYC — 4–5 days on-site per week (no relocation)

Employment Type: Full-time

Interview: Video

Note: Must work off-hours 1–2 days/week in the first few months to overlap with Singaporean teams

Role Overview

A leading global financial services firm is seeking a Senior Vice President, Exposure Management to serve as the Global Head of Exposure Management within its Cybersecurity Assurance & Defence (CSAD) team. This senior leadership role owns the strategy, roadmap, and enterprise-wide execution of the firm's threat exposure and vulnerability management program.

The ideal candidate is a deeply experienced security practitioner (15+ years) with a background spanning Application Security, Vulnerability Management, Red Team, and Penetration Testing, who can operate as a control owner and primary interface for internal and external audit while influencing stakeholders across technology and business — including trading desks.

Key Responsibilities

· Define and execute the exposure and vulnerability management strategy, aligned with enterprise risk appetite, regulatory requirements, and business objectives.

· Establish and mature a forward-looking, risk-based threat exposure management program at enterprise scale, integrating threat intelligence, security analytics, and automation.

· Maintain continuous visibility of the enterprise attack surface — external, cloud, on-premises, hybrid, and identity-based — moving from reactive scanning to proactive exposure reduction.

· Lead and govern scanning and assessment activities, ensuring consistent standards, accuracy, timely mitigation, and transparent reporting.

· Drive risk-based prioritization using threat context, exploitability, attack-path analysis, and business criticality.

· Employ exposure validation techniques — attack path modelling, breach and attack simulation, red team exercises, and penetration testing — to confirm real-world risk and measure control effectiveness.

· Serve as a control owner: drive threat prioritization, root cause analysis, and cross-team remediation to prevent recurrence.

· Act as the primary interface for internal and external audit and manage security programs for the business.

· Develop, update, and manage exposure, vulnerability, and security patch management standards.

· Define and track KPIs, KRIs, and program maturity metrics.

· Communicate complex technical exposures to senior management and business stakeholders to drive informed, risk-based decisions.

· Build and lead a high-performing team; develop and manage budgets with a global mindset.

· Stay abreast of global cybersecurity trends, emerging vulnerabilities, exploits, and regulatory developments.

Required Qualifications

· 15+ years in cybersecurity, with at least 7 years in senior leadership overseeing exposure and vulnerability management operations.

· Proven experience establishing or maturing a threat exposure management (or equivalent risk-based) program at enterprise scale.

· Background across Application Security, Vulnerability Management, Red Team, and Penetration Testing.

· Expertise across the exposure management lifecycle: attack surface management, vulnerability management tools, exposure assessment and prioritization, penetration testing, continuoautomated validation (e.g., BAS), threat intelligence, and AI/automation.

· Strong grasp of risk-based prioritization, attack-path analysis, and exposure validation.

· Deep understanding of regulatory environments, financial services operations, and technology risk management.

· Proven track record of leading large-scale cybersecurity programs.

· Excellent communication and stakeholder management skills, with the ability to influence at all levels — technical teams, senior management, and business/trading stakeholders.

· Global mindset and financial literacy for budget development.

· Degree in Computer Science, Information Security, or related field preferred; certifications (SANS, OFFSEC, CISSP, CISM, CRISC, etc.) desirable.