Senior Security Manager - Vulnerability Management

We are seeking a Senior Security Manager, Vulnerability Management to own and mature Alter Domus’s enterprise vulnerability management program and drive continuous reduction of our attack surface. Reporting to the CISO, you will lead the strategy, tooling, and operating cadence for identifying, prioritizing, and remediating vulnerabilities across infrastructure, cloud, and business applications — while leading a small team and representing the program in governance, audit, and executive reporting forums. 

KEY RESPONSIBILITIES:

Vulnerability Management Program Leadership 

• Own and continuously mature the end-to-end enterprise Vulnerability Management (VM) program — policy, scanning cadence, risk-based prioritization, and remediation SLAs — across on-premises, cloud, and hybrid environments. 

• Build, lead, and develop a small team of vulnerability management analysts/engineers, setting priorities and managing delivery against program KPIs. 

• Partner with Infrastructure, Application, and DevOps teams to drive timely remediation of critical and high-risk findings; manage formal risk-acceptance and exception processes for items that cannot be remediated on schedule. 

• Identify and reduce the organization’s attack surface, including unmanaged assets, shadow IT, and internet-facing exposures, in partnership with IT and Network teams. 

Vulnerability Management Platform Deployment & Operations 

• Own the deployment, configuration, and ongoing administration of the enterprise vulnerability management (VM) scanning and detection–response platform across the enterprise estate. 

• Drive scanner/agent coverage expansion, asset discovery accuracy, and integration of the VM platform with ITSM/ticketing and CMDB tools. 

• Continuously tune scan policies, authentication, and reporting configurations to improve detection accuracy and reduce false positives. 

• Evaluate and recommend enhancements to the VM tooling stack as the threat landscape and business needs evolve. 

AI-Augmented Vulnerability Management 

• Leverage AI/ML-driven risk scoring and predictive exploitability signals (beyond static CVSS) to sharpen remediation prioritization and focus analyst effort on the highest-impact exposures. 

• Evaluate and adopt AI-assisted capabilities within the VM platform — automated finding triage, deduplication, and correlation with threat intelligence — to increase remediation velocity and reduce manual analyst workload. 

• Extend vulnerability and attack surface management practices to AI/ML assets in use across the business — models, training data pipelines, and AI-enabled applications — identifying and remediating AI-specific exposures. 

• Partner with Security Governance on emerging AI risk frameworks (e.g., NIST AI RMF, OWASP Top 10 for LLM Applications) where they intersect with vulnerability and configuration management practices. 

Governance, Metrics & Reporting 

• Design and maintain executive and operational reporting (KPIs/KRIs, remediation SLA performance, risk trends) for the CISO, technology leadership, and risk committees. 

• Own and keep current the vulnerability management policies, standards, and procedures in line with the evolving threat landscape and regulatory expectations. 

• Present program status, risk posture, and remediation progress at security governance forums and, as needed, executive-level updates. 

Audit & Compliance 

• Serve as the primary control owner for vulnerability and configuration management controls during SOC 2 (Type I/II) and related audits (e.g., ISO 27001, client due-diligence reviews). 

• Manage evidence collection, auditor engagement, and remediation tracking for audit findings tied to vulnerability, patch, and configuration management. 

• Support broader information security governance activities, including risk assessments and control testing, as needed. 

PREFERRED EXPERIENCE & QUALIFICATIONS:

The ideal candidate will bring deep, hands-on expertise in vulnerability and attack surface management, with demonstrated leadership in regulated financial services environments. Preferred experience includes: 

Leadership & General 

• 10+ years of information security experience, including 5+ years leading or managing a vulnerability management or attack surface management function — ideally within financial services or another regulated industry. 

• Proven track record of representing risk and program status to senior stakeholders, translating technical findings into clear business narrative. 

• Proven people-management experience, with a track record of building, coaching, and developing a small security team. 

Technical Skills 

• Hands-on experience deploying, administering, and optimizing an enterprise vulnerability management (VM) platform at scale. 

• Working knowledge of CIS Benchmarks, CVE/CVSS scoring, and secure configuration and hardening practices across Windows, Linux, cloud (AWS/Azure), and network infrastructure. 

• Experience leading or coordinating vulnerability assessments and penetration testing of business applications, and turning findings into actionable remediation plans. 

• Direct experience as a control owner supporting SOC 2 (Type I/II) or comparable compliance audits (e.g., ISO 27001, NIST CSF). 

• Strong written and verbal communication skills, with the ability to present risk and program metrics to both technical and executive/non-technical audiences. 

AI & Automation 

• Familiarity with AI/ML-driven vulnerability prioritization and risk-scoring capabilities (e.g., predictive exploitability, threat-intel correlation) available in modern VM platforms. 

• Familiarity with using or evaluating AI-powered automation for vulnerability triage, deduplication, or remediation-guidance generation. 

• Working knowledge of AI/LLM-specific risk considerations (e.g., OWASP Top 10 for LLM Applications, model and data-pipeline exposures) as they relate to attack surface and vulnerability management. 

• Practical use of generative AI tools to accelerate reporting, documentation, or remediation playbooks is a plus. 

Certifications (Preferred) 

CISSP, CISM, GCVA, GPEN, or equivalent. AI/ML security credential (e.g., GIAC AI Security Automation Engineer – GASAE) a plus.