Senior Cybersecurity Risk & Vulnerability Management Advisor

The Vanguard Group•Malvern, PA

1d•Hybrid

About The Position

Leads vulnerability risk management and remediation oversight across technology environments. The Advisor analyzes infrastructure vulnerability data to validate risk, applicability, ownership, remediation status, and reporting accuracy; identifies themes and actionable insights; and performs targeted outreach to drive resolution. The role develops and communicates vulnerability posture, trends, remediation deadlines, and material exposures to senior leadership; monitors security dashboards and risk metrics; investigates reporting discrepancies; and improves reporting accuracy. Serves as the technical risk liaison between Global Technology Operations (GTO) and security stakeholders. The Advisor helps infrastructure operations teams navigate the security organization, clarify security dependencies, remove roadblocks, and achieve strategic outcomes. The role translates technical findings into actionable business-risk information and advises technology teams on security requirements, risk-treatment decisions, and enterprise security initiatives. Drives cross-functional remediation initiatives and coordinates resolution of high-risk security findings across GTO, Enterprise Security, infrastructure, application, engineering, technology owners, and supporting teams. Partners with technology teams on vulnerability root-cause analysis, control and process gaps, and security practices to prevent, detect, and remediate future issues. Develops and leads security assessment plans to evaluate information security controls; identifies vulnerabilities, integration requirements and implications, emerging security needs, and corrective measures; and works with IT subdivisions, third-party partners, and business units to assess and communicate security risks and operational impacts of technology implementations. Evaluates security requirements for data systems, networks, and websites; identifies enterprise technical security solutions; and coordinates adoption of security initiatives and solutions. Facilitates escalation and resolution of vulnerabilities approaching remediation deadlines or requiring management attention, and manages vendor relationships. Maintains knowledge of emerging security practices, standards, policies, and industry trends, and leads engagement and enablement of the Security Champion community. Participates in special projects and performs other duties as assigned. Vanguard describes its work model as hybrid for the majority of crew members, intended to support flexibility alongside in-person learning, collaboration, and connection.

Requirements

At least eight years of related work experience.
Undergraduate degree in a related field, or an equivalent combination of training and experience.
Demonstrated experience interfacing with, presenting to, and reporting to senior-level leadership, including translating complex technical and security information into clear, actionable business-risk narratives.
Strong written and verbal communication skills and executive presence; ability to communicate effectively with technical and non-technical stakeholders.
Strong technical acumen and understanding of infrastructure and cloud operations, with the ability to partner effectively with infrastructure and other technical teams.
Knowledge of cybersecurity frameworks and security best practices, particularly NIST, and ability to identify control and process gaps and recommend corrective actions.
Strong relationship-management, persuasion, and influencing capabilities across security and technology stakeholders.

Nice To Haves

Experience in IT security or application development.
Previous experience as a Business Information Security Officer (BISO), IT Risk Manager, IT Controls Manager, or in a similar technical security governance and reporting role.
Experience supporting technology or infrastructure organizations in a security, risk, controls, or governance capacity.
Familiarity with cloud computing concepts and ITIL.
Familiarity with security and risk platforms such as Archer, Wiz, and Qualys.
Experience using reporting and productivity tools such as Tableau and Microsoft 365; Tableau experience is preferred but not required.
A security certification such as ISC2 CISSP, GIAC Security Essentials Certification (GSEC), GIAC Penetration Tester Certification (GPEN), GIAC Web App Pen Tester (GWPN), or Certified Ethical Hacker (CEH).

Responsibilities

Lead vulnerability risk management and remediation oversight across technology environments.
Analyze infrastructure vulnerability data to validate risk, applicability, ownership, remediation status, and reporting accuracy; identify themes and actionable insights; and conduct targeted outreach to drive resolution.
Develop and communicate vulnerability posture, trends, remediation deadlines, and material exposures to senior leadership.
Monitor security dashboards and risk metrics, investigate reporting discrepancies, and improve reporting accuracy.
Serve as the technical risk liaison between GTO and security stakeholders, helping infrastructure operations teams clarify dependencies, navigate the security organization, remove roadblocks, and enable strategic outcomes.
Translate technical findings into actionable business-risk information and advise technology teams on security requirements, risk-treatment decisions, and enterprise security initiatives.
Drive cross-functional remediation initiatives and coordinate resolution of high-risk security findings across GTO, Enterprise Security, infrastructure, application, engineering, technology owners, and supporting teams.
Partner with infrastructure, networking, platform, and other technology teams to perform vulnerability root-cause analysis, identify security control or process gaps, and recommend practices to prevent, detect, and remediate future issues.
Develop and lead security assessment plans to evaluate the adequacy of information security controls; identify vulnerabilities, integration requirements and implications, emerging security needs, and corrective measures.
Work with IT subdivisions, third-party partners, and business units to assess and communicate security risks and operational impacts of technology implementations.
Evaluate security requirements for data systems, networks, and websites; identify enterprise technical security solutions; and coordinate adoption of security initiatives and solutions.
Facilitate escalation and resolution of vulnerabilities nearing remediation deadlines or requiring additional management attention, and manage vendor relationships.
Maintain knowledge of emerging security practices, standards, policies, and industry trends, and lead engagement and enablement of the Security Champion community.
Participate in special projects and perform other duties as assigned.