Director, Cyber Exposure & Vulnerability Management

Fifth Third Bank • Cincinnati, OH

4d • Remote

About The Position

Fifth Third Bank is seeking a Director of Cyber Exposure & Vulnerability Management to lead two critical cybersecurity functions: Enterprise Vulnerability Remediation and Exposure Analysis & Coordination. This leader is responsible for reducing enterprise cyber risk by driving vulnerability remediation and coordinating the response to significant technology exposures across the Bank. The role combines strategic leadership and operational execution, partnering with senior technology leaders to prioritize remediation efforts, improve exposure management processes, and strengthen the Bank's cybersecurity posture. In addition to leading the vulnerability remediation program, this Director will help mature a growing Exposure Analysis & Coordination capability focused on rapidly assessing and coordinating the Bank's response to emerging cybersecurity risks that require urgent action and cross-functional engagement. This is a highly visible leadership role that partners closely with Information Security, Technology, Risk Management, and executive leadership.

Requirements

• 10+ years of experience in cybersecurity, technology risk, security operations, vulnerability management, or related disciplines.
• Experience leading enterprise-scale remediation, risk reduction, security operations, or response coordination programs.
• Strong knowledge of vulnerability management practices, risk prioritization methodologies, and cyber risk governance.
• Demonstrated ability to lead large cross-functional initiatives across complex organizations.
• Experience presenting to senior leaders and executive audiences.
• Strong executive communication and stakeholder management skills.
• Proven ability to influence outcomes without direct authority.
• Experience managing teams, budgets, priorities, and strategic initiatives.

Nice To Haves

• Experience within a large regulated financial services organization and FFIEC and PCI requirements.
• Experience supporting regulatory examinations, audits, and enterprise risk governance activities.
• Familiarity with vulnerability management, security analytics, asset management, GRC, and workflow management platforms.
• Experience with cloud, infrastructure, application, and third-party technology security.
• Experience operating within Agile or SAFe environments.
• Professional certifications such as CISSP, CISM, CRISC, GIAC, or equivalent.

Responsibilities

• Lead the enterprise vulnerability remediation program, including governance, reporting, escalation, and stakeholder coordination.
• Partner with application, infrastructure, cloud, and security teams to drive timely risk reduction.
• Establish remediation priorities, performance metrics, and service-level expectations.
• Support audits, regulatory examinations, and enterprise risk governance activities.
• Continuously improve remediation workflows, reporting, and prioritization processes.
• Lead the Bank's Exposure Analysis & Coordination function.
• Coordinate enterprise response to significant technology exposures, including: Zero-day vulnerabilities, Emerging and pre-CVE threats, Vendor advisories, Third-party technology exposures, Cloud security exposures.
• Drive cross-functional assessment, prioritization, mitigation tracking, and executive communications.
• Ensure significant exposure events are consistently governed, documented, escalated, and resolved.
• Lead post-event reviews and operational improvements.
• Translate vulnerability, threat, and exposure data into actionable risk decisions.
• Advise senior leaders on remediation priorities, business impact, and risk tradeoffs.
• Identify systemic issues and opportunities for long-term risk reduction.
• Define strategy, roadmaps, metrics, and maturity objectives for the Remediation and Exposure Management functions.
• Establish scalable operating processes, playbooks, and governance models.
• Drive continuous improvement using Agile and Lean practices.
• Align cybersecurity priorities with technology investment, capacity, and risk reduction objectives.
• Lead and develop security engineers and analysts.
• Coach emerging leaders and strengthen organizational capabilities.
• Build a culture of accountability, collaboration, and continuous improvement.
• Ensure teams can effectively support both planned remediation efforts and rapidly evolving cyber threats.

Benefits

• Comprehensive benefits
• Differentiated compensation offerings
• Incentive compensation plan
• Extensive benefits programs designed to support the individual needs of our employees and their families, encompassing physical, financial, emotional and social well-being.

What This Job Offers

• Job Type: Full-time
• Career Level: Director
• Education Level: No Education Listed