Senior Director, Exposure & Vulnerability Management

WTW•Charlotte, NC

1d•$180,000 - $240,000

About The Position

WTW is seeking a Senior Director of Exposure & Vulnerability Management to lead WTW's vulnerability management security program. This leader owns the strategy, execution and evolution of enterprise exposure management capabilities spanning vulnerability operations, exposure validation, aligning with secure development (SAST/SCA/DAST) and risk intelligence, with a relentless focus on prioritization, business impact, mitigation strategies and measurable risk reduction. The role partners closely with various technology and risk stakeholders to ensure security findings are translated into actionable insight, aligned remediation priorities and demonstrably improved security outcomes across the enterprise. As a senior member of the Attack Surface Management leadership team, the Senior Director also acts as a strategic deputy to the Global Head, contributing to program direction, investment decisions, steering committee deliverables, and executive-level reporting. The Exposure & Vulnerability Management function is accountable for transforming how security risk is identified, contextualized, validated and addressed across the enterprise. This includes shifting to a unified, continuous exposure management model that is aligned to Continuous Threat Exposure Management (CTEM) principles and built on an accurate, authoritative view of WTW's assets. The Senior Director will lead multi-disciplinary global teams while driving modernization across data, tooling, metrics, governance and engagement models.

Requirements

10+ years in information security, technology risk or IT, including 7+ years leading enterprise-scale vulnerability, exposure or security programs in a large, complex, global organization.
Proven experience leading multi-disciplinary, geographically distributed teams, including leaders of leaders.
Deep understanding of vulnerability management, application security (SAST/SCA), cloud security and modern software delivery environments.
Hands-on familiarity with risk-based prioritization approaches, threat intelligence, and exposure validation techniques.
Demonstrated ability to move program from operational execution to strategic, outcome-driven models.
Strong data-driven mindset, with experience using metrics and analytics to influence decisions and behavior.
Track record of leading transformation initiatives across people, process and technology, including tool rationalization and vendor management.
Experience operating in a regulated industry (financial services, insurance or similar) and engaging with regulators and auditors.
Comfortable operating at both strategic and execution levels, translating vision into measurable results.
Exceptional communication skills, with the ability to convey complex technical risk in business-relevant terms to executive and Board audiences.

Nice To Haves

Experience in Cloud computing environments and with ServiceNow-based or equivalent remediation workflows.
Experience implementing a CTEM or equivalent continuous exposure management model.
Familiarity with frameworks such as NIST CSF, ISO 27001, CIS Controls and FAIR or other risk quantification approaches.
Relevant certifications such as CISSP, CISM, CRISC or equivalent.
Bachelor's degree in Computer Science, Information Security or a related field, or equivalent experience.

Responsibilities

Define and own WTW's enterprise exposure & vulnerability management strategy and a multi-year roadmap that aligns infrastructure, cloud, application, identity and software supply chain risk into a unified risk view.
Operationalize a continuous exposure & vulnerability management lifecycle (scoping, discovery, prioritization, validation and mobilization) aligned to CTEM principles.
Track vulnerabilities via risk-based prioritization grounded in exploitability, threat intelligence, asset criticality, exposure and business impact.
Establish clear ownership models, accountability and engagement patterns with technology and engineering teams to drive timely and effective remediation.
Own the annual operating plan and budget for exposure & vulnerability management, building business cases for investment and demonstrating return in terms of risk reduction.
Ensure continuous, comprehensive discovery of exposures across on-premises, cloud technologies, endpoints, IoT, SaaS and internet-facing attack surfaces.
Partner with the Asset Management team to ensure exposure data is anchored to an accurate, authoritative asset inventory (CMDB), including ownership, business service mapping and criticality tiering.
Ensure exposure coverage includes misconfigurations, cloud posture, identity and access weaknesses, external attack surface and unmanaged or shadow assets.
Own and continuously refine WTW's risk-based vulnerability scoring and prioritization model, incorporating exploit prediction (e.g. EPSS), known-exploited intelligence (e.g. CISA KEV), threat intelligence, compensating controls and business context.
Establish exposure validation capabilities, including attack path analysis, breach and attack simulation, and coordination with penetration testing and red team functions, to confirm real-world exploitability.
Define and maintain risk-tiered remediation SLAs that differentiate by exposure, asset type and business criticality.
Lead global teams responsible for vulnerability operations, ensuring consistent, scalable execution of discovery, validation, prioritization, tracking and closure across technology domains.
Drive remediation mobilization through integrated workflows, clear hand-offs to owning teams and escalation paths for overdue or high-risk exposures.
Lead WTW's response to critical and emerging vulnerabilities (e.g. zero-days and widely exploited flaws), coordinating rapid impact assessment, executive communication and accelerated remediation with Security Operations, Incident Response and Technology.
Maintain availability for critical and emerging vulnerability events (e.g. zero-days), including participation in an on-call rotation or escalation structure to ensure rapid impact assessment and response outside of standard business hours.
Own the vulnerability risk exception and acceptance process, ensuring exceptions are risk-assessed, time-bound, approved at the appropriate level and tracked to resolution.
Partner with Application Security and Business Technology leadership to embed SAST, DAST and SCA coverage and the broader application security toolchain — contributing risk-based prioritization methodology and ensuring application findings feed into the same risk-ranked queue as infrastructure and cloud exposures, rather than owning the toolchain itself.
Support Application Security's efforts to embed security earlier in the SDLC by aligning exposure & vulnerability management's remediation workflow, SLAs, and reporting with their developer-friendly tooling and pipeline guardrails — extending consistent tracking and accountability to application-layer findings without taking on pipeline ownership.
Collaborate with Application Security, Business Technology, and GRC to strengthen software supply chain risk management — including open-source governance and SBOM practices — providing exposure-management visibility, prioritization, and reporting rather than owning the program.
Own the policies, standards and procedures governing vulnerability and exposure management, ensuring they are current, enforceable and consistently applied.
Ensure the program meets regulatory and contractual obligations across WTW's operating jurisdictions, including DORA, NYDFS Part 500, GDPR and relevant client and industry requirements.
Serve as the accountable lead for exposure & vulnerability management in engagements with regulators, Internal Audit, external auditors and client security assessments, and own remediation of related findings.
Partner with Enterprise Risk and the second line to align exposure metrics with WTW's cyber risk appetite, key risk indicators and risk register.
Assess and govern exposure risk introduced through acquisitions, divestitures and third-party or managed service providers.
Build and mature exposure-focused metrics and KRIs that enable leadership to understand risk posture, trends, remediation effectiveness and SLA performance.
Partner with data and analytics teams to leverage security telemetry, automation and correlation across multiple data sources.
Translate technical findings into clear, decision-ready insight for the CISO, executive leadership, risk committees and, where required, the Board.
Drive modernization of exposure & vulnerability management tooling, workflows and integrations, including consolidation and rationalization of overlapping tools.
Identify and deliver opportunities for automation, orchestration and responsible use of AI to scale prioritization, triage and remediation.
Partner with Product, Business Technology, Engineering, Cloud Operations, and Architecture teams to influence platform capabilities and security-by-design practices.
Own vendor and managed service relationships for exposure & vulnerability management, including selection, contract governance and performance management.
Lead, coach and develop high-performing teams across multiple disciplines and geographies, including managers of managers.
Design the organization, roles and career paths for the function; build succession and a strong bench of future leaders.
Foster a culture of collaboration, accountability and continuous improvement, breaking down silos between vulnerability, asset and application security teams.
Serve as a trusted advisor to Technology, Security and Risk leadership on exposure trends and remediation priorities.
Influence cross-functional stakeholders without direct authority in a complex, matrixed, global environment.

Benefits

Medical (including prescription coverage)
Dental
Vision
Health Savings Account
Commuter Account
Health Care and Dependent Care Flexible Spending Accounts
Group Accident
Group Critical Illness
Life Insurance
AD&D
Group Legal
Identify Theft Protection
Wellbeing Program
Work/Life Resources (including Employee Assistance Program)
Paid Holidays
Annual Paid Time Off (includes paid state/local paid leave where required)
Short-Term Disability
Long-Term Disability
Other Leaves (e.g., Bereavement, FMLA, ADA, Jury Duty, Military Leave, and Parental and Adoption Leave)
Paid Time Off (Washington State only)
Contributory Pension Plan
Savings Plan (401k)