Director of Vulnerability Management

CNA • Chicago, IL

1d • $97,000 - $189,000 • Hybrid

About The Position

You have a clear vision of where your career can go. And we have the leadership to help you get there. At CNA, we strive to create a culture in which people know they matter and are part of something important, ensuring the abilities of all employees are used to their fullest potential. This is a hybrid role based in Chicago, IL This role leads CNA’s enterprise-wide Vulnerability Management program, blending deep technical expertise with strategic leadership to safeguard assets across hybrid environments. The ideal candidate is a seasoned leader with proven experience managing vulnerability management teams and influencing cross-functional stakeholders. Expert-level proficiency with Tenable tools is mandatory, as is hands-on oversight of Managed Service Providers (MSPs) to ensure SLA compliance and technical quality. The position requires familiarity with Unified Vulnerability Management (UVM) concepts and Continuous Threat Exposure Management (CTEM) approaches to drive a proactive, risk-based strategy. Responsibilities include developing and executing policies, standards, and governance aligned with business and regulatory requirements, while ensuring vulnerabilities are identified, prioritized, and remediated effectively. Success in this role demands exceptional technical depth, strong leadership, and the ability to communicate complex risk and remediation strategies in clear business terms.

Requirements

• Strong hands-on expertise with Tenable.sc, Tenable.io, or equivalent enterprise vulnerability scanning tools.
• Proven track record of leading vulnerability management programs and teams with expert-level knowledge and competence in security concepts and strategies and the ability to successfully implement them.
• Hands-on experience with leading vulnerability management tools at enterprise scale and strong technical understanding and experience assessing vulnerabilities and identifying weaknesses in legacy and modern assets and applications located on-premises and in the cloud.
• Expertise in identifying , evaluating, and prioritizing vulnerabilities with in CNA's environment, pair e d with the capability to design and implement holistic remediation strategies that effectively address both immediate and long-term risks across CNA.
• Excellent written and verbal communication s and interpersonal skills to work effectively with peers, leadership, and subordinates.
• Must be able to clearly communicate complex technical and business concepts both to business partners, internal and external teams, and leadership.
• Strong analytical and project management skills.
• Proven ability to effectively lead, manage, coach, and develop a team. This includes both direct leadership but also cross-functional capabilities.
• Proven experience managing MSP relationships, including SLA enforcement and technical oversight.
• 6+ years in a vulnerability management program. Knowing not only how to assess vulnerabilities but also prioritize and drive remediation activities.
• Experience interacting with auditors and regulators.
• Experience and comfort working across evolving cloud and on-premises hybrid environments and technologies.
• Self-starter with the ability to make independent data-driven decisions and the judgment to know when to seek guidance.
• Expert-level understanding of key vulnerability management and information security concepts, such as: risk , severity , exploitability, CVE, CVSS, asset management, secure configuration management, etc .
• Ability to foster collaborative, open, working relationships with stakeholders.
• Strong understanding of enterprise, network, endpoint, and application-level security issues and risks.
• Solid understanding of operating systems (Windows, Linux, Unix), networking, cloud platforms ( GCP, AWS, Azure), and common enterprise application stacks.
• Bachelor's degree in Computer Science , or related discipline, or equivalent work experience.
• Typically, a minimum of ten years’ related work experience in Information Technolog y.

Nice To Haves

• CISSP, CISM, PMP, Tenable or equivalent certifications preferred.

Responsibilities

• Leads and executes a comprehensive Vulnerability Management program throughout a global technology organization leveraging legacy and modern assets and applications located on-premise s and in the cloud .
• Own and operate the enterprise vulnerability management program, including vulnerability scanning, reporting, and remediation tracking.
• Builds and nurtures strong partnerships with asset owners and managed service providers to drive vulnerability remediation, mitigation, reduce exposure and potential business impact, and ensure secure asset configuration s .
• Oversee and technically validate the MSP’s delivery of vulnerability scanning and assessments using Tenable tools.
• Accountable for the vulnerability remediation process within CNA, which may include vulnerabilities discovered through, but not limited to, vulnerability scan ning , ethical hacking , threat intelligence, application security , responsible disclosure, e tc.
• Holistically owns the secure configuration management process within CNA, which may include working with various team s in developing secure technical specifications for technologies, assessing the environment against those specifications, and continuously improving the posture through governance and technical leadership.
• Develops enterprise policy, standards, plans, strategy, and procedures with specific regard to vulnerability management and secure configuration in alignment with business, industry, and regulatory requirements ensuring adherence across the enterprise to avoid audit findings and compliance gaps .
• Develops and presents VM program metrics, KPIs, KRIs , and other applicable performance reporting measures to communicate risk and program effectiveness to governance and leadership.
• Perform detailed analysis of vulnerability data to identify trends, recurring issues, and systemic weaknesses, and use this analysis to prioritize remediation efforts based on risk and business impact.
• Identifies , recommends, and prioritizes appropriate measures to manage and remediate vulnerabilities and reduce potential impacts on information resources to acceptable risk tolerances.
• Successfully partners with other teams to risk assess potential impact from vulnerabilities and recommend s appropriate compensating security controls.
• Mentor and develop a team of vulnerability management professionals, fostering a culture of continuous learning and operational excellence.
• Be a champion for vulnerability management and information security including broadening awareness and use of the team's services, education of security best practices and integration with other business areas.
• Lead, mentor, and develop an internal vulnerability management team (FTEs and contractors).
• Serve as primary point of contact and escalation for the MSP, holding them accountable to SLAs, quality standards, and performance metrics.
• Communicate vulnerability risks, trends, and remediation progress to senior leadership, including executives and the Board, in clear business terms.
• Partner with application and infrastructure owners to ensure remediation activities are prioritized and executed effectively.
• May perform additional duties as assigned.

Benefits

• CNA offers a comprehensive and competitive benefits package to help our employees – and their family members – achieve their physical, financial, emotional and social wellbeing goals.
• For a detailed look at CNA’s benefits, please visit cnabenefits.com .
• CNA is committed to providing reasonable accommodations to qualified individuals with disabilities in the recruitment process. To request an accommodation, please contact [email protected] .

What This Job Offers

• Job Type: Full-time
• Career Level: Director
• Number of Employees: 5,001-10,000 employees