Want to know if this job is worth applying to?
United States
Remote only
Not Available
This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Manager, Vulnerability Management based in the United States.
This fully remote leadership role offers the opportunity to shape and lead a comprehensive Product Vulnerability Management program across multiple products and services. You will establish the strategy, operating model, and capabilities needed to identify, assess, and address security vulnerabilities throughout the product lifecycle. Working closely with Product Security, Engineering, Development, and other internal teams, you will help embed security practices into development workflows while enabling teams to work efficiently. The position combines strategic direction, technical oversight, team leadership, and stakeholder engagement. You will also represent the vulnerability management function in customer and external security discussions, reporting directly to the CISO. This is an impactful opportunity to strengthen product security and continuously improve security practices in a collaborative, fast-moving environment.
Design and implement the Product Vulnerability Management operating model, covering people, processes, and technology while applying agile best practices.
Lead and develop the Vulnerability Management team, fostering a collaborative, high-performing culture and supporting recruitment, technical screening, and professional growth.
Partner with Product Security and Product Development teams to integrate security into development processes and enable developers to address vulnerabilities effectively.
Oversee product security scanning tools and capabilities, including SAST, SCA, DAST, and CSPM solutions.
Manage the vulnerability disclosure program and processes for responding to security inquiries from customers and researchers.
Establish and monitor vulnerability management processes, service-level agreements, performance metrics, and reporting.
Lead the planning, scheduling, and allocation of resources for vulnerability management initiatives, ensuring delivery within agreed timelines, scope, and budgets.
Collaborate with Cybersecurity, IT, Product, Operations, and other stakeholders to align security initiatives with regulatory, industry, and organizational requirements.
Serve as the primary contact for external product security inquiries, escalating significant matters to senior leadership and relevant stakeholders.
Drive continuous improvement by applying industry best practices, emerging threat intelligence, and lessons learned.
Prepare and present program updates, performance reports, and risk assessments to executives, stakeholders, and auditors.
Participate in customer-facing discussions and review customer contracts to address product security requirements and concerns.
Bachelor's degree in Computer Science, Information Security, Business Administration, or a related discipline; a master's degree is preferred.
At least 8 years of relevant experience in Product Security, Application Security, or Vulnerability Management.
Experience establishing, managing, and continuously improving a Vulnerability Management program.
Previous leadership experience in Product Security or Vulnerability Management; 3 or more years is preferred.
Strong understanding of the current product security threat landscape, vulnerability management practices, and industry trends.
Experience supporting recruitment, technical interviews, team development, and performance management.
Ability to balance business priorities with security requirements and develop practical, innovative solutions.
Strong communication, leadership, and interpersonal skills, with the ability to influence stakeholders across technical and business teams.
Excellent analytical, organizational, and prioritization skills, including the ability to manage competing demands and meet deadlines.
Strong executive communication and presentation capabilities, including experience explaining security measures to diverse audiences.
Willingness to travel occasionally, with expected travel below 10%.
Preferred: Knowledge of cybersecurity frameworks, risk management principles, and standards such as NIST, ISO 27001, CIS, GDPR, FedRAMP, and Common Criteria.
Preferred: Relevant certifications such as CISSP, CISM, CSSLP, CCSP, or equivalent.
Preferred: Familiarity with Jira and Confluence, as well as a background in software development.
Work authorization: Candidates must already be authorized to work in the United States without current or future sponsorship. This includes restrictions on candidates requiring visas or other employer-supported work authorization, such as H-1B, TN, L-1, F-1 OPT/CPT, and J-1.
Estimated base salary of $175,000–$200,000, depending on experience, skills, business needs, and location.
Equity opportunities.
Eligibility for performance-based bonuses or role-specific incentive programs.
Healthcare insurance.
Retirement or pension matching.
Comprehensive life insurance.
Employee assistance program.
Paid time off plans and company holidays.
Opportunities for meaningful work, professional development, and career progression.
A collaborative, innovation-focused environment that values trust, respect, ownership, adaptability, and diverse perspectives.
