Vulnerability Management Manager

The Vulnerability Management Manager, working closely with the information security team, leads the enterprise vulnerability management program, overseeing the continuous identification, assessment, prioritization, and remediation of vulnerabilities across operating systems, applications, and infrastructure components. This role designs and governs program strategy, collaborates cross-functionally with security and operations teams, and ensures remediation efforts align with Firm’s risk tolerance, regulatory obligations, and industry best practices.

Key Responsibilities: 

·       Lead the assessment, prioritization, and remediation tracking of vulnerabilities across enterprise endpoints, servers, and cloud environments, collaborating with information security, and IT teams to align remediation activities with identified threats.

·       Evaluate vulnerability criticality using risk-based frameworks (CVSS, EPSS, CISA KEV) in conjunction with threat intelligence and business context to drive informed remediation decisions

·       Design and maintain vulnerability remediation and patching schedules, phased rollout plans, and maintenance windows that minimize business impact while satisfying security and compliance requirements

·       Ensure timely patching of enterprise desktops, servers, and applications by coordinating with product owners and patch management teams, tracking deployment status, enforcing remediation SLAs, and ensuring exceptions are documented and risk-accepted through a formal process

·       Correlate vulnerability scan findings with patch deployment status to identify coverage gaps, report on compliance rates, and escalate systemic gaps or high-risk exceptions to the information security team

·       Lead emergency and out-of-band patching efforts for actively exploited or critical vulnerabilities, coordinating rapid deployment with minimal business disruption

·       Perform advanced troubleshooting for complex or high-risk vulnerabilities, working with system administrators, application owners, and engineering teams on remediation or compensating controls

·       Enforce patch compliance standards, ensuring patching activities align with organizational policy and frameworks such as NIST and CIS Controls

·       Document vulnerability management procedures, baselines, exception handling, and reporting methods to support audits and continuous improvement

·       Develop and deliver reporting on vulnerability trends, program KPIs, and risk exposure for both technical teams and executive leadership