AVP Vulnerability Management Program Manager

First Financial Bank•Antis Township, PA

2d•Hybrid

About The Position

The Assistant Vice President, Vulnerability Management Program Manager leads the ongoing administration, governance, and continuous improvement of First Financial Bankshares' enterprise Vulnerability Management Program. This role ensures vulnerabilities are identified, prioritized, tracked, remediated, validated, reported, and evidenced in accordance with approved standards, risk management expectations, and applicable regulatory requirements. The position provides dedicated program leadership across Information Security, technology operations, application teams, risk management, Internal Audit, third-party providers, and other stakeholders. The role translates technical exposure into clear business risk, drives remediation accountability, coordinates governance and reporting, and helps maintain a sustainable and demonstrably effective program.

Requirements

Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Business Administration, Risk Management, or a related field, or an equivalent combination of education and relevant experience.
Seven or more years of progressive experience in cybersecurity, information security, technology risk, technology operations, or a related discipline.
Three or more years of experience leading vulnerability management, cyber risk, security operations, governance, or comparable enterprise programs.
Demonstrated experience coordinating cross-functional remediation or risk-reduction initiatives in a complex technology environment.
Working knowledge of vulnerability assessment, risk-based prioritization, remediation governance, exception management, validation, metrics, and evidence practices.
Experience communicating technical risk, program performance, and decisions to management and non-technical stakeholders.
Strong written communication, facilitation, organization, analytical judgment, and stakeholder management skills.

Nice To Haves

MBA or advanced technical degree (Computer Science, Cybersecurity, Information Systems)
Experience in banking, financial services, or another highly regulated industry.
Experience supporting Internal Audit, independent assessments, or regulatory examinations.
Experience building, formalizing, or maturing an enterprise vulnerability management or cyber risk program.
Knowledge of recognized cybersecurity and control frameworks, including NIST Cybersecurity Framework, NIST Special Publication 800-53, CIS Controls, and FFIEC cybersecurity guidance.
Professional certification such as CISSP, CISM, CRISC, CGRC, GIAC, PMP, or a comparable credential.
Experience with enterprise vulnerability assessment, workflow, reporting, data visualization, or security automation platforms.

Responsibilities

Lead the day-to-day administration and ongoing maturity of the enterprise Vulnerability Management Program.
Maintain the program roadmap, governance documentation, operating procedures, standards alignment, and recurring review activities.
Coordinate the Vulnerability Management Council, including agendas, decisions, action items, escalations, and follow-through.
Promote consistent execution of program requirements across technology functions, support organizations, and applicable business units.
Oversee the vulnerability lifecycle from identification and validation through prioritization, remediation, exception management, risk acceptance, and closure.
Ensure prioritization considers exploitability, asset criticality, business impact, exposure, and other approved risk factors.
Monitor aging, overdue items, recurring issues, and material exposure; coordinate timely escalation and corrective action.
Provide oversight of vulnerabilities affecting internally managed, jointly managed, and vendor-managed technology environments.
Coordinate remediation activity across infrastructure, endpoints, networks, applications, databases, cloud services, and third-party technology providers.
Partner with accountable technology owners to establish remediation plans, remove execution barriers, and confirm sustainable closure.
Oversee dedicated vulnerability remediation resources and coordinate supplemental partner support as appropriate.
Validate that closure and exception records contain sufficient evidence to demonstrate appropriate disposition.
Produce and maintain recurring program reporting for management and established governance bodies, including performance, risk, trend, maturity, and enhancement information.
Monitor approved service levels, key performance indicators, key risk indicators, backlog, aging, exceptions, and remediation outcomes.
Present program status and material issues in clear business terms to executive management, risk committees, Internal Audit, and other stakeholders.
Maintain consistent definitions, methodologies, and supporting evidence for reported measures.
Coordinate vulnerability management evidence for Internal Audit, independent reviews, and regulatory examinations.
Maintain organized, complete, and repeatable evidence of program operation, governance decisions, remediation activity, reporting, exceptions, and management oversight.
Support responses to audit and regulatory requests and track related commitments through resolution.
Identify control or evidence gaps and coordinate timely corrective action.
Assess program effectiveness and recommend improvements to processes, governance, reporting, technology enablement, automation, and resource alignment.
Monitor relevant threat, vulnerability, regulatory, and industry developments and evaluate their implications for the program.
Promote integration of vulnerability management practices into technology operations, change management, asset management, configuration management, and third-party oversight.
Support training, awareness, and role clarity for stakeholders with vulnerability management responsibilities.
Provide direction, coaching, and performance support for assigned team members and program resources.
Build productive relationships across cybersecurity, technology, risk, audit, compliance, and business functions.
Influence outcomes without relying solely on direct authority and foster shared accountability for risk reduction.
Perform other duties and responsibilities as assigned.