Senior Director, Cyber Exposure Management

AstraZeneca•Gaithersburg, MD

9d•Hybrid

About The Position

Are you ready to turn exposure data into decisive action that protects the science, manufacturing and digital platforms patients rely on every day? Based in Gaithersburg, Maryland, you will own our enterprise understanding of vulnerabilities and weaknesses—and drive closure before an attacker finds them. You will lead three complementary capabilities: Vulnerability Management, Application Security and Penetration Testing/Red Team, operating between builders and defenders to ensure our technology and platforms are resilient when it matters most. This is a build-and-uplift mandate. You will move us from scan-and-ticket to modern, risk-based exposure management; stand up application security as a true assurance function; and evolve offensive testing into a continuous, intelligence-led capability. How would you partner across engineering, cloud, product and operations to prioritize real-world risk at machine speed and validate that our defenses work when it counts?

Requirements

Risk-based vulnerability management: Prioritization using asset criticality, exploitability and intelligence; remediation governance and SLA management at enterprise scale.
Application security: Secure SDLC, SAST/DAST/SCA, threat modelling, API and cloud-native application security, and developer enablement that changes behavior rather than just reporting findings.
Offensive security: Penetration testing and adversary emulation across applications, infrastructure, cloud and OT, and the use of purple teaming to improve detection.
Attack surface and cloud: External and internal attack surface management across cloud, SaaS and third-party exposure.
Software supply chain: Open-source and third-party component risk, SBOM practice and rapid response to widely exploited components.
AI-era exploitation: How machine-speed vulnerability discovery and weaponization change prioritization, and the security considerations of the organization’s own AI systems.
Regulated and OT context: Exposure management in GxP and OT/ICS environments where patching and testing are constrained by validation, safety and uptime.
Remediation through others: Driving fixes through asset-owning teams, governing risk acceptance and keeping reporting defensible.
Bachelor's degree or equivalent experience in information security, computer science or a related field, or equivalent practical experience.
Ten or more years in cybersecurity, including significant experience across vulnerability, application or offensive security.
Five or more years leading exposure, application security or offensive functions in a large enterprise, including at least two years managing other people leaders.
Demonstrable record of maturing a vulnerability or application security program and measurably reducing risk.
Proven track record to drive remediation through teams you do not control, across IT, Cloud, Engineering and business units.
Ability to explain exposure and prioritization in clear business terms and to brief senior executives and risk committees.
Ability to prioritize finite remediation capacity against real-world risk and business pragmatism.
Experience leading distributed teams across multiple regions and cultures.

Nice To Haves

CISSP, CISM, OSCP, GIAC (GWAPT, GPEN, GXPN, GCPN) or equivalent.
Pharmaceutical, life sciences, healthcare or another highly regulated industry with manufacturing OT exposure.
Experience briefing an audit committee, board or risk committee on exposure and remediation.
Experience selecting and governing scanning, application security and offensive tooling and specialist testing partners.
Working proficiency in a second language relevant to our delivery hubs.

Responsibilities

Own and deliver a multi-year strategy across Vulnerability Management, Application Security and Penetration Testing, with clear roadmaps, budgets and capability plans; set direction with a high degree of autonomy.
Evolve from volume-based scanning to prioritized exposure management using asset criticality, exploitability and threat intelligence; implement enterprise remediation governance and SLAs.
Maintain continuous visibility of internal and external attack surfaces—including cloud, SaaS and third-party exposure—and focus effort where real-world risk is highest.
Run a secure development assurance program covering SAST, DAST and SCA; drive developer enablement and behaviors for software we build and buy.
Oversee software composition risk, SBOM practices and rapid response to widely exploited components; guide investment and policy.
Operate a continuous program of penetration testing and adversary emulation across applications, infrastructure, cloud and OT; run purple-team exercises with Threat Management to harden detection and response.
Prepare for machine-speed exploit generation by automating discovery, prioritization and validation; assess the security of AI and large language model systems.
Drive fixes through accountable asset owners; escalate and govern risk acceptance; keep the reporting honest and defensible.
Own exposure KRIs—mean time to remediate, SLA attainment, recurrence, coverage, critical exposure ageing—and report credibly to senior leadership and risk committees.
Feed findings from offensive testing and cyber intelligence into prioritization; incorporate incident learnings so testing reflects how we are actually being attacked.
Translate technical exposure into business risk the CISO, IT leadership and the Board can act on; defend prioritization decisions under scrutiny.
Lead and uplift a multi-disciplinary team of roughly eighteen across regions; raise posture from operational scanning to strategic exposure management while preserving independence and integrity.
Manage the leaders of Vulnerability Management, Application Security and Penetration Testing; set objectives, review performance and build succession.
Recruit inclusively; develop career paths and upskilling in exposure management, cloud and application security, offensive testing and automation; leverage regional and external partnerships.
Own budgets for scanning, application security and offensive tooling and specialist partners; build the investment cases that maximize business risk reduction.