Senior Director - Security Posture & Exposure Management

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Senior Director – Security Posture & Exposure Management based in the United States .

The Senior Director will lead enterprise-wide vulnerability management and security exposure reduction across complex technology environments. This strategic, hands-on leadership role is responsible for identifying security weaknesses, assessing their real-world risk, and ensuring timely remediation across cloud, on-premises infrastructure, applications, endpoints, and specialized environments. You will oversee multiple security functions, including vulnerability management, application security, offensive security, advanced vulnerability discovery, and exposure reporting. By combining deep technical expertise with organizational leadership, you will transform vulnerability scanning into a risk-based, data-driven security capability. Working closely with technology leaders, security operations, and risk management teams, you will strengthen accountability and improve the organization's overall security posture. This is an opportunity to shape enterprise security strategy, develop high-performing teams, and deliver measurable reductions in cyber risk.

Accountabilities •

Define enterprise vulnerability management strategy: Own the technical strategy, architecture, operating model, roadmap, and performance outcomes for end-to-end vulnerability management across cloud environments, on-premises infrastructure, applications, endpoints, and operational technology or laboratory systems.

•

Lead security teams and organizational development: Manage and develop leaders and teams across vulnerability management, application security, offensive security, advanced vulnerability discovery, finding validation, prioritization, and exposure reporting. Establish clear priorities, develop talent, and maintain accountability for results.

•

Oversee enterprise scanning and discovery: Direct the architecture and performance of the enterprise scanning environment, including asset coverage, scan health, authenticated and agent-based scanning, asset reconciliation, tooling selection, and integration with ticketing systems, configuration management databases, and reporting platforms.

•

Establish risk-based prioritization: Develop and enforce prioritization frameworks that incorporate vulnerability severity, exploitability, threat intelligence, asset criticality, and exposure context. Ensure findings are validated and resources are focused on the weaknesses that pose the greatest business risk.

•

Drive remediation and accountability: Establish remediation service-level agreements (SLAs), escalation procedures, exception processes, and clear ownership models. Work with technology owners and their leadership to accelerate remediation and demonstrate measurable improvements.

•

Oversee application and offensive security programs: Integrate application security findings into enterprise-wide vulnerability management, including static and dynamic application security testing and software composition analysis. Guide offensive security and advanced discovery activities, ensuring findings lead to systemic improvements rather than isolated fixes.

•

Manage exposure reporting and analytics: Own executive reporting, technology-owner scorecards, risk trends, remediation progress, and the underlying data pipelines and metrics. Ensure reporting is accurate, actionable, and suitable for executive decision-making and audit review.

•

Provide technical leadership and escalation: Serve as the senior technical authority for disputed findings, severity assessments, exploitability decisions, false positives, and risk exceptions. Evaluate scanning configurations and prioritization models, identify coverage gaps, and direct improvements.

•

Coordinate with security and technology stakeholders: Partner with security operations, incident response, threat intelligence, risk and compliance, internal audit, platform owners, and application teams to prioritize actively exploited vulnerabilities and incorporate lessons from security incidents.

•

Manage risk acceptance and mitigation: Document mitigation strategies and oversee risk acceptance when vulnerabilities cannot be fully eliminated, ensuring residual exposure is accurately communicated and approvals meet audit and governance requirements.

•

Oversee budgets and external partnerships: Manage departmental budgets, vendor relationships, contracts, and workforce planning, including external and offshore resources, to ensure effective delivery and operational scalability.

Requirements

•

High school diploma or equivalent, with at least 4 years of experience in cybersecurity, information technology, or a related field.

•

At least 10 years of hands-on professional cybersecurity experience, primarily in vulnerability management, security operations, offensive security, or a closely related discipline.

•

At least 5 years of experience leading a security function, with a minimum of 3 years managing people leaders.

•

Extensive practical experience with vulnerability management platforms, security scanning, exploitability analysis, attack surface management, and remediation opera

How Jobgether works: We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team. We appreciate your interest and wish you the best! Why Apply Through Jobgether? Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time. #LI-CL1