Principal - Vulnerability Remediation

Ally•Charlotte, NC

2d•$110,000 - $180,000

About The Position

The Principal of Cyber Security is a key individual contributor to Ally Financial’s Vulnerability Management program. The role analyzes and reports on enterprise security vulnerabilities, coordinates remediation with application and infrastructure teams, assesses threat profiles and business risks, and provides clear reporting to senior management. It transforms large volumes of technical data into actionable insights to improve security posture and support timely risk reduction. The position reports to the Director of Vulnerability Management and collaborates across cybersecurity, technology, and operations. The role works extensively with Qualys, ServiceNow, AWS-related scanning and cloud security technologies, and other enterprise vulnerability and remediation tracking tools. Ally will not sponsor a new applicant for employment authorization for this position.

Requirements

At least 7 years of relevant experience, as specified in the Minimum Qualifications section.
Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, Information Systems, Engineering, Data Analytics, or a related technology-focused field, or equivalent.
At least 5 years of relevant experience in vulnerability management, cybersecurity operations, security analytics, or a related information security discipline.
At least 3 years of experience with vulnerability management and workflow tools such as Qualys and ServiceNow, and cloud security or scanning technologies in environments including AWS.
Experience supporting criticality assessments for assets, applications, or vulnerabilities using threat intelligence inputs, business context, exposure factors, and risk-based prioritization methods.
Strong analytical skills, including the ability to work with large data sets, interpret technical findings, and translate them into clear business and risk insights.
Ability to collaborate effectively across technical and non-technical teams to drive remediation outcomes.
Working knowledge of vulnerability scoring, remediation prioritization, patching concepts, and common infrastructure, application, and cloud security risks.
Strong written and verbal communication skills, including the ability to present findings and trends to senior leadership.

Nice To Haves

Knowledge of threat intelligence, exploitability analysis, and risk-based vulnerability management practices.
Experience in highly regulated or complex enterprise environments.

Responsibilities

Analyze vulnerability scan results and related security data to identify trends, prioritize findings, and support risk-based remediation decisions.
Coordinate with application, infrastructure, cloud, and platform teams to ensure vulnerabilities are remediated within established service level expectations.
Assess vulnerability threat profiles, exploitability, and potential business impact to guide remediation prioritization.
Perform and document asset, application, and vulnerability criticality assessments requested by the Cyber Threat Intelligence team, incorporating threat context, business impact, exposure, and operational relevance.
Prepare and deliver recurring and ad hoc senior-management reports on vulnerability metrics, remediation performance, and emerging risk themes.
Validate and track remediation activities, exceptions, and aging findings to ensure accurate status reporting and accountability.
Partner with cybersecurity, engineering, and operations stakeholders to improve vulnerability management processes, data quality, and reporting effectiveness.
Maintain documentation, reporting standards, and operational procedures supporting vulnerability governance.
Use vulnerability management and workflow platforms to monitor findings, assign actions, and measure remediation progress.

Benefits

At least 20 paid time-off days, 11 paid holidays, and 8 hours of annual volunteer time off; time off is prorated based on start date and varies by full- or part-time status and management level.
401(k) retirement savings plan with matching and company contributions.
Student loan pay-down and 529 educational savings assistance programs.
Tuition reimbursement.
Employee stock purchase plan.
Financial learning center and financial coach access.
Flexible medical, dental, and vision insurance options.
Life insurance for employees, spouses, and children.
Short- and long-term disability insurance.
Health Savings Account with employer contributions and Healthcare FSA.
Critical illness, accident, and hospital indemnity insurance.
Total well-being program supporting physical, social, emotional, and financial well-being.
Adoption, surrogacy, and fertility assistance.
Paid parental and caregiver leave.
Dependent Day Care FSA, backup child and adult/elder care days, and childcare discounts.
Employee Assistance Program.
Subsidized and discounted Weight Watchers program and other employee discount programs.
Depending on the role, possible travel allowances, relocation assistance, signing bonus, and/or equity.
Market-competitive base pay and eligibility to participate in the annual incentive plan.