Senior Director - Security Posture & Exposure Management

Job description

**This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Senior Director – Security Posture & Exposure Management based in the United States.** The Senior Director will lead enterprise-wide vulnerability management and security exposure reduction across complex technology environments. This strategic, hands-on leadership role is responsible for identifying security weaknesses, assessing their real-world risk, and ensuring timely remediation across cloud, on-premises infrastructure, applications, endpoints, and specialized environments. You will oversee multiple security functions, including vulnerability management, application security, offensive security, advanced vulnerability discovery, and exposure reporting. By combining deep technical expertise with organizational leadership, you will transform vulnerability scanning into a risk-based, data-driven security capability. Working closely with technology leaders, security operations, and risk management teams, you will strengthen accountability and improve the organization's overall security posture. This is an opportunity to shape enterprise security strategy, develop high-performing teams, and deliver measurable reductions in cyber risk. ### Accountabilities - Define enterprise vulnerability management strategy: Own the technical strategy, architecture, operating model, roadmap, and performance outcomes for end-to-end vulnerability management across cloud environments, on-premises infrastructure, applications, endpoints, and operational technology or laboratory systems. - Lead security teams and organizational development: Manage and develop leaders and teams across vulnerability management, application security, offensive security, advanced vulnerability discovery, finding validation, prioritization, and exposure reporting. Establish clear priorities, develop talent, and maintain accountability for results. - Oversee enterprise scanning and discovery: Direct the architecture and performance of the enterprise scanning environment, including asset coverage, scan health, authenticated and agent-based scanning, asset reconciliation, tooling selection, and integration with ticketing systems, configuration management databases, and reporting platforms. - Establish risk-based prioritization: Develop and enforce prioritization frameworks that incorporate vulnerability severity, exploitability, threat intelligence, asset criticality, and exposure context. Ensure findings are validated and resources are focused on the weaknesses that pose the greatest business risk. - Drive remediation and accountability: Establish remediation service-level agreements (SLAs), escalation procedures, exception processes, and clear ownership models. Work with technology owners and their leadership to accelerate remediation and demonstrate measurable improvements. - Oversee application and offensive security programs: Integrate application security findings into enterprise-wide vulnerability management, including static and dynamic application security testing and software composition analysis. Guide offensive security and advanced discovery activities, ensuring findings lead to systemic improvements rather than isolated fixes. - Manage exposure reporting and analytics: Own executive reporting, technology-owner scorecards, risk trends, remediation progress, and the underlying data pipelines and metrics. Ensure reporting is accurate, actionable, and suitable for executive decision-making and audit review. - Provide technical leadership and escalation: Serve as the senior technical authority for disputed findings, severity assessments, exploitability decisions, false positives, and risk exceptions. Evaluate scanning configurations and prioritization models, identify coverage gaps, and direct improvements. - Coordinate with security and technology stakeholders: Partner with security operations, incident response, threat intelligence, risk and compliance, internal audit, platform owners, and application teams to prioritize actively exploited vulnerabilities and incorporate lessons from security incidents. - Manage risk acceptance and mitigation: Document mitigation