Manager- Threat and Vulnerability Management

Role: Manager- Threat & Vulnerability Management 

1. Vulnerability Management Program Leadership

• Design, implement, and mature the enterprise-wide Vulnerability Management Program aligned with business risk appetite.
  
• Establish standardized processes for vulnerability identification, assessment, prioritization, remediation, and validation.
  
• Define and enforce risk-based remediation SLAs based on asset criticality and exposure.
  
• Oversee vulnerability scanning across networks, endpoints, databases, applications, APIs, and cloud platforms.
  
• Ensure coverage across internal assets, internet-facing systems, and third-party integrations.
  

2. Threat Intelligence & Threat Management

• Establish and operationalize a Threat Intelligence capability to monitor emerging threats, attack vectors, and adversary tactics.
  
• Correlate threat intelligence with internal vulnerabilities to identify exploitable risks.
  
• Track global threat trends (e.g., ransomware, zero-day exploits, supply chain risks) and assess organizational exposure.
  
• Provide actionable threat insights to SOC, incident response, and leadership teams.
  

3. Risk-Based Prioritization & Remediation Governance

• Drive risk-based vulnerability prioritization using CVSS, exploitability, threat context, and business impact.
  
• Integrate vulnerability data with enterprise risk registers and GRC platforms.
  
• Work closely with IT, DevOps, cloud, and application teams to ensure timely remediation.
  
• Track remediation progress, exceptions, and compensating controls.
  
• Establish governance forums to review vulnerability posture and drive accountability.
  

4. Application & Cloud Security Integration

• Collaborate with DevSecOps teams to embed vulnerability management into CI/CD pipelines.
  
• Oversee SAST, DAST, SCA, and container security scanning practices.
  
• Ensure cloud-native vulnerability management across IaaS, PaaS, and SaaS environments.
  
• Support secure configuration baselines and continuous posture management.
  

5. Metrics, Reporting & Continuous Improvement

• Define and track key metrics such as vulnerability aging, remediation SLAs, exposure trends, and risk reduction.
  
• Develop dashboards and reports for senior leadership and board-level visibility.
  
• Conduct periodic program reviews, maturity assessments, and benchmarking against industry standards.
  
• Continuously enhance tools, processes, and automation capabilities.
  

6. Red Teaming, Threat Modeling & Proactive Testing

• Drive periodic penetration testing, red teaming, and adversary simulation exercises.
  
• Conduct threat modeling for critical applications, systems, and new initiatives.
  
• Validate effectiveness of security controls against real-world attack scenarios.
  

7. Stakeholder Management & Collaboration

• Partner with IT, Engineering, Cloud, SOC, Risk, and Compliance teams to ensure alignment.
  
• Act as a subject matter expert on vulnerability and threat management for internal stakeholders.
  
• Support audits, regulatory requirements, and third-party risk assessments.
  

Preferred Certifications

• CISSP / CISM / CRISC
  
• CEH / OSCP (preferred for technical depth)
  
• GIAC certifications (e.g., GPEN, GWAPT, GCIH)
  
• ISO 27001 Lead Auditor / Implementer
  

Key Competencies

• Risk-based decision-making and prioritization
  
• Strong analytical and problem-solving skills
  
• Deep understanding of threat landscape and attack methodologies
  
• Ability to translate technical risk into business impact
  
• Strong stakeholder management and influencing skills
  
• High ownership, accountability, and execution focus
  

Requirements

• 8–12+ years of experience in cybersecurity, with strong focus on vulnerability management and threat intelligence.
  
• Experience in BFSI / Insurance sector preferred.
  
• Hands-on experience with vulnerability management tools (e.g., Qualys, Tenable, Rapid7, etc.).
  
• Strong understanding of enterprise architecture, cloud platform (Azure), and application security.
  
• Familiarity with regulatory expectations (e.g., IRDAI, RBI, ISO 27001, NIST CSF).