Tech Risk and Controls Lead-Vulnerability Management, Network security controls

Join a role that's central to our technological controls and standards, offering a unique opportunity to shape the firm's tech controls strategy in alignment with various standards and regulatory requirements.

As a Tech Risk and Controls Lead at JPMorganChase within Cybersecurity Technology and Controls, you will lead the enterprise governance and orchestration of the Vulnerability Management function. Serving as the central governance lead and connective layer across Vulnerability Management Product, Engineering, Operations, Risk Intelligence, Standards and Control Design, control owners, and line-of-business teams, you will establish clear decision rights, integrate end-to-end oversight, and drive consistent outcomes without displacing technical execution or remediation accountability. The role combines cybersecurity risk and controls expertise with enterprise leadership to strengthen discovery and coverage efficacy, material-change governance, systemic issue management, metrics, regulatory readiness, and continuous improvement across cloud, data center, endpoint, application, container, and other technology environments.

Job responsibilities

• Lead the enterprise Vulnerability Management governance function, providing a central coordination point for cross-functional accountability, governance challenge, and escalation
• Establish and maintain the Vulnerability Management governance charter, operating model, decision rights, forums, RACI, materiality thresholds, and escalation pathways
• Orchestrate collaboration across Vulnerability Management Product, Engineering, Operations, Risk Intelligence, Standards and Control Design, control owners, Product Security, and line-of-business teams while preserving clear technical and remediation ownership
• Chair or coordinate enterprise Vulnerability Management governance forums, ensuring working groups prepare complete evidence and decision-making bodies record accountable, timely, and traceable outcomes
• Govern material changes to discovery, coverage, feeds, integrations, scoring, filtering, bundling, exemptions, and inclusion or exclusion rules through documented impact assessment, testing, approval, communication, and post-implementation validation
• Drive systemic root-cause and thematic analysis of vulnerabilities, control failures, recurring defects, data-quality issues, and finding concentrations; translate insights into enterprise corrective actions with clear ownership and tracked closure
• Define and oversee enterprise metrics and reporting that measure discovery and coverage efficacy, control outcomes, governance health, service performance, rule compliance, remediation trends, and downstream impact
• Coordinate enterprise responses to systemic issues and ensure local remediation, exception, and risk-acceptance decisions remain with the appropriate control and business owners
• Partner with the Vulnerability Management Product or Service Owner on strategy, roadmap, prioritization, capability uplift, annual coverage review, and the distinction between routine improvement and material enterprise change
• Coordinate with Audit, Compliance, Operational Risk, and regulatory engagement teams to ensure Vulnerability Management leaders can provide coherent, evidence-based explanations of firmwide scope, methodology, control outcomes, and material decisions
• Promote automation, reusable governance patterns, and auditable workflows that improve the quality, timeliness, and traceability of Vulnerability Management decisions and follow-through

Required qualifications, capabilities, and skills

• Formal training or certification on tech risk and controls concepts and 10+ years applied experience in cybersecurity, technology risk, Vulnerability Management, security engineering, product or service governance, or controls leadership, including experience leading across organizational boundaries
• Demonstrated experience establishing or leading an enterprise Vulnerability Management governance, control tower, service-integration, or comparable cross-functional oversight capability
• Deep understanding of the Vulnerability Management lifecycle, including asset and provider coverage, discovery, scanning, intake, triage, risk rating, routing, remediation, exceptions, validation, reporting, and closure
• Proven ability to define decision rights, governance forums, RACI models, change-control gates, materiality criteria, escalation mechanisms, evidence requirements, and outcome-based metrics
• Experience governing complex Vulnerability Management ecosystems and data flows across multiple tools, providers, platforms, and hybrid technology environments
• Strong analytical capability in discovery and coverage efficacy, systemic root-cause analysis, thematic analysis, control effectiveness, data quality, and enterprise risk reporting
• Executive presence and the ability to challenge constructively, resolve accountability gaps, influence senior stakeholders, and communicate complex technical and risk topics in clear business terms
• Experience supporting Audit, Compliance, Operational Risk, and regulatory engagements, with strong discipline in evidence, decision traceability, issue management, and audit-defensible documentation
• Working knowledge of governance, risk, and compliance platforms, Vulnerability Management technologies, cloud and container security, enterprise data and reporting tools, and automation-enabled control monitoring
• Demonstrated experience using enterprise-authorized AI capabilities to support cybersecurity risk and controls workflows, with rigorous validation, data-sensitivity awareness, and human accountability for decisions

Preferred qualifications, capabilities, and skills

• Professional certifications such as CISSP, CISM, CRISC, GIAC, or relevant cloud security certifications
• Experience operating within large, complex financial services or regulated industry environments with significant regulatory and audit scrutiny
• Familiarity with AI-enabled governance tooling and the application of automation to control monitoring, evidence synthesis, and executive reporting
• Exposure to enterprise risk frameworks, regulatory requirements, and industry standards relevant to Vulnerability Management and cybersecurity controls
• Experience designing or contributing to enterprise-wide communication protocols for governance decisions, systemic issues, and executive-level reporting

#CTC