Director, Exposure Operations

Fidelity National Financial•Jacksonville, FL

2d•$170,000 - $200,000•Remote

About The Position

FNF® is the leading provider of title insurance and settlement services to the real estate and mortgage industries. FNF®'s various mortgage and real estate services companies provide services that complement our title insurance business. From a full-service qualified intermediary, home warranties, UCC insurance, relocation services, and notary services, we provide essential services to fulfill the needs of a changing real estate industry. FNF® believes the power of technology can elevate the real estate transaction. From investments in title and escrow software to industry-leading real estate partner solutions, we take our commitment to provide real estate professionals and consumers with a truly reimagined, transparent, connected, and trusted real estate experience to heart. POSITION OVERVIEW The Director, Exposure Operations leads the design, implementation, and continuous improvement of the enterprise Exposure Management operating model. Reporting to the VP, Security Platforms & Exposure Management, this role oversees Exposure Intelligence, Exposure Remediation & Tracking, and Exposure Validation, ensuring security findings translate into prioritized action and measurable risk reduction. This leader establishes the processes, workflows, governance, and accountability needed to manage exposures across infrastructure, applications, identity, attack surfaces, security baselines, and offensive security findings. The Director also defines the business requirements that guides the organization’s exposure management technology platform and operationalizes the risk prioritization.

Requirements

Bachelor’s degree or the equivalent combination of educating, training, and work experience.
Demonstrated experience in technical vulnerability management, exposure management, or closely related security operations functions.
Experience building or significantly maturing security programs, including designing and implementing scalable processes, governance, and operational workflows.
Strong knowledge of vulnerability analysis, risk assessment, exposure prioritization, and risk-based remediation.
Understanding of security exposures across infrastructure, applications, identity, and external attack surfaces.
Experience establishing remediation ownership, tracking progress, managing escalations, and driving accountability across multiple teams.
Ability to translate security and operational needs into clear business requirements for engineering and technology partners.
Experience developing security metrics, exposure analytics, and reporting for technical stakeholders and executive leadership.
Demonstrated ability to develop a long-term strategic vision and translate it into actionable roadmaps and operational improvements.
Strong communication, stakeholder management, and influencing skills, with the ability to drive outcomes across teams without direct reporting authority.

Nice To Haves

Experience leading enterprise technical vulnerability management or exposure management programs in a large, complex organization.
Experience integrating threat intelligence, security operations insights, and business context into exposure prioritization.
Familiarity with application security, attack surface management, identity security, security baseline assessments, and offensive security findings.
Experience developing validation processes that confirm remediation effectiveness and demonstrate measurable risk reduction.
Experience partnering with engineering teams to improve security platforms, workflow orchestration, scoring, and reporting capabilities.
Demonstrated success using automation to reduce manual operational effort and improve the speed and consistency of remediation workflows.
Experience driving adoption of new security processes and governance practices across distributed technology and business teams.

Responsibilities

Lead the exposure management operating model, including exposure analysis and prioritization, remediation and tracking, and validation.
Design and run the end-to-end exposure lifecycle: intake, analysis, prioritization, remediation, escalation, validation, and closure.
Set consistent processes for managing findings across infrastructure, applications, identity, attack surface, security configurations, and offensive security activities.
Build and carry out a multi-year roadmap that aligns processes, governance, metrics, and technology requirements with enterprise security objectives.
Build and mature risk-based prioritization that combines technical severity, exploitability, business context, and compensating controls to support consistent remediation decisions.
Set up remediation governance, including ownership, tracking, escalation, and accountability across technology and business teams.
Define validation requirements and workflows that confirm remediation worked and measure exposure reduction.
Own the business requirements and operational workflows that guide how exposure management platforms are developed and adopted.
Work with engineering teams to prioritize platform enhancements, automation, workflow improvements, and future capabilities.
Produce exposure analytics, operational metrics, and executive reporting on risk, remediation progress, program effectiveness, and areas that need leadership attention.
Find ways to cut manual effort and improve consistency through security automation and workflow optimization.
Work with infrastructure, application, identity, security operations, and business stakeholders to drive remediation and risk reduction across teams the role doesn't directly manage.
Keep improving the operating model as threats, business needs, and program maturity goals change.