Senior Cybersecurity Risk & Vulnerability Management Advisor

Vanguard•Malvern, PA

2d•Hybrid

About The Position

The Senior Cybersecurity Risk & Vulnerability Management Advisor leads vulnerability risk management and remediation oversight across technology environments. The role validates infrastructure vulnerability data, assesses risk and applicability, confirms ownership and remediation status, identifies trends and actionable insights, and conducts outreach to advance resolution. It communicates vulnerability posture, trends, deadlines, and material exposures to senior leadership while monitoring security dashboards and improving reporting accuracy. The Advisor serves as a technical risk liaison between Global Technology Operations (GTO) and security stakeholders. The role helps infrastructure operations teams navigate security requirements, remove roadblocks, and achieve strategic outcomes; translates technical findings into business-risk information; and coordinates cross-functional remediation of high-risk findings. It also leads security assessments, evaluates controls and security requirements, identifies gaps and corrective measures, and coordinates adoption of enterprise security solutions. The position partners with technology teams, business units, and third parties to assess security risks and operational impacts, conduct root-cause analysis, and prevent or address vulnerabilities. It facilitates escalations, manages vendor relationships, keeps current on security practices and industry trends, and leads engagement and enablement of the Security Champion community. The role may also participate in special projects and perform other assigned duties. Vanguard describes its work model as hybrid for the majority of crew members, balancing flexibility with in-person learning, collaboration, and connection.

Requirements

Minimum eight years of related work experience.
Undergraduate degree in a related field or an equivalent combination of training and experience.
Demonstrated experience interfacing with, presenting to, and reporting to senior-level leadership, including translating complex technical and security information into clear, actionable business-risk narratives.
Strong written and verbal communication skills, executive presence, and ability to communicate effectively with technical and non-technical stakeholders.
Strong technical acumen and understanding of infrastructure and cloud operations, with ability to partner effectively with infrastructure and other technical teams.
Knowledge of cybersecurity frameworks and security best practices, particularly NIST, and ability to identify control and process gaps and recommend corrective actions.
Strong relationship-management, persuasion, and influencing capabilities across security and technology stakeholders.

Nice To Haves

Experience in IT security or application development.
Previous experience as a Business Information Security Officer (BISO), IT Risk Manager, IT Controls Manager, or in a similar technical security governance and reporting role.
Experience supporting technology or infrastructure organizations in a security, risk, controls, or governance capacity.
Familiarity with cloud computing concepts and ITIL.
Familiarity with security and risk platforms such as Archer, Wiz, and Qualys.
Experience using reporting and productivity tools such as Tableau and Microsoft 365; Tableau experience is preferred but not required.
A security certification such as ISC2 CISSP, GIAC Security Essentials Certification (GSEC), GIAC Penetration Tester Certification (GPEN), GIAC Web App Pen Tester (GWPN), or Certified Ethical Hacker (CEH).

Responsibilities

Lead vulnerability risk management and remediation oversight across technology environments.
Analyze infrastructure vulnerability data to validate risk, applicability, ownership, remediation status, and reporting accuracy; identify trends and actionable insights; and conduct targeted outreach to drive resolution.
Communicate vulnerability posture, trends, remediation deadlines, and material exposures to senior leadership.
Monitor security dashboards and risk metrics, investigate reporting discrepancies, and improve reporting accuracy.
Act as the technical risk liaison between GTO and security stakeholders, helping infrastructure operations teams clarify security dependencies, navigate the security organization, remove roadblocks, and achieve strategic outcomes.
Translate technical findings into actionable business-risk information and advise technology teams on security requirements, risk-treatment decisions, and enterprise security initiatives.
Drive cross-functional remediation initiatives and coordinate resolution of high-risk security findings across technology and supporting teams.
Partner with infrastructure, networking, platform, and other technology teams to perform vulnerability root-cause analysis, identify control or process gaps, and recommend practices to prevent, detect, and remediate future issues.
Develop and lead security assessment plans to evaluate information security controls; identify vulnerabilities, integration requirements and implications, emerging needs, and corrective measures.
Work with IT subdivisions, third-party partners, and business units to assess and communicate security risks and the operational impacts of technology implementations.
Evaluate security requirements for data systems, networks, and websites; identify enterprise technical security solutions; and coordinate adoption of security initiatives and solutions.
Facilitate escalation and resolution of vulnerabilities nearing remediation deadlines or requiring management attention, and manage vendor relationships.
Maintain knowledge of emerging security practices, standards, policies, and industry trends.
Lead engagement and enablement of the Security Champion community.
Participate in special projects and perform other duties as assigned.