Senior Director, Technical Vulnerability Management & Remediation Orchestration

News Corp • New York City, NY

7d • Hybrid

About The Position

The Senior Director of Technical Vulnerability Management (VM) & Remediation Orchestration is the global operational leader responsible for defining, driving, and scaling News Corp’s enterprise vulnerability remediation strategy. Reporting to the SVP, Infrastructure & Enterprise Technology, this leader heads the central Vulnerability Remediation Services function and serves as the operational bridge between Enterprise Cyber Security, Technology Operations and Service Management, Infrastructure, and business unit leadership across News Corp’s global businesses.

The role partners with Cyber Security, which owns core vulnerability management scanning tools and policy, and Technology Operations and Service Delivery, which own the CMDB and asset topology. Its mandate is to leverage and mature reporting and ticket orchestration, drive remediation and compliance through Continuous Threat Exposure Management (CTEM) frameworks, ensure SLA compliance, and establish regular reporting with Global Technology and business partners. The position is based in NYC and requires working in the office at least three days per week.

Requirements

• 10+ years of experience in Information Technology with substantial involvement in Security, IT Risk, or Cybersecurity operations.
• 5+ years in a global leadership or Senior Director-level role managing enterprise vulnerability programs.
• Deep expertise in enterprise vulnerability management, remediation orchestration, patch management, risk-based prioritization, and vulnerability detection across complex IT and cloud environments.
• Proven ability to influence engineering, DevOps, technology, and business teams in a global matrixed organization without direct line authority.
• Exceptional communication and stakeholder management skills, including the ability to translate complex technical risks into clear, business-focused insights for senior executives and Board-level stakeholders.
• Strong understanding of modern vulnerability management, security, and orchestration technologies, including platforms such as Qualys, Tenable, Wiz, Snyk, Defender for Cloud, Jira, and ServiceNow.
• Bachelor’s degree in Computer Science, Information Technology, or a related field.

Nice To Haves

• Relevant certifications such as CISSP, CISM, or CRISC.

Responsibilities

• Establish and execute a unified global vulnerability remediation strategy across cloud environments, infrastructure, applications, containerized workloads, and edge systems, using CTEM principles to scope, discover, prioritize, validate, and mobilize remediation.
• Define and maintain enterprise vulnerability remediation processes and SLAs tailored to asset criticality and business context.
• Partner with business unit executives, engineering heads, and IT Directors to align remediation policies and findings with operational constraints and product roadmaps.
• Serve as the primary operational partner to business unit VM Champions and technical leads, providing actionable insights and identifying bottlenecks to meeting remediation SLAs.
• Partner with Cyber Security to evaluate scanning coverage, including SAST, DAST, SCA, CSPM, and EASM, and align detection feeds with evolving threat models, policy requirements, and vendor consolidation strategy.
• Establish and govern standardized global vulnerability remediation workflows, patch windows, maintenance schedules, and remediation cadences across critical infrastructure and application tiers.
• Create and maintain an enterprise Responsibility Matrix (RACI) defining ownership and handoffs between vulnerability management, cyber security, shared infrastructure services, and business-unit-managed platforms.
• Work with business unit engineering and operations leaders to define and operationalize localized patch regimens and asset lifecycle plans, including roadmaps for end-of-life and out-of-service-life technologies.
• Design, implement, and maintain automated remediation workflows in Jira and ServiceNow, translating normalized scan findings into prioritized action items for system and application owners.
• Lead cross-business-unit governance meetings and vulnerability steering committees to track issues, resolve resource bottlenecks, and maintain alignment.
• Establish risk-acceptance and escalation pathways for unresolved risks, aged vulnerabilities, and exceptions; present risk-acceptance profiles and exposure reviews to executive leadership and risk committees.
• Partner with Cyber Security to ensure appropriate vulnerability identification tooling is evaluated, implemented, and managed.
• Advance risk-based vulnerability management and exposure validation by using threat intelligence, exploitability data such as EPSS and KEV, and business impact to prioritize remediation.
• Coordinate monitoring of vendor security advisories, CVEs, product updates, and end-of-life notifications with platform owners and Cyber Security, ensuring emerging threats are assessed, assigned, and remediated.
• Coordinate vendor architectural reviews with platform owners to identify security misconfigurations, architectural weaknesses, and design vulnerabilities, and ensure findings are risk-assessed, prioritized, and remediated.
• Drive automation and AI use across vulnerability management, asset identification, CMDB accuracy, scanning, remediation, and reporting.
• Partner with Cyber Security to evaluate, consolidate, and rationalize security vendors and platforms across business units to reduce complexity, improve architectural consistency, and maximize return on security investments.
• Lead root-cause analysis of recurring systemic vulnerabilities and promote DevSecOps practices, automated security gates, and shift-left controls in CI/CD pipelines.
• Define and monitor vulnerability management KPIs and KRIs, delivering measurable performance improvement over 6–12 months, including reduced MTTR for critical and high vulnerabilities and 90%+ SLA compliance across business units.
• Develop global and business-unit risk dashboards and executive reporting for the CISO, CTO, Risk Committee, and Board, covering key vulnerabilities, trends, remediation progress, and residual risk.

Benefits

• Competitive and flexible compensation.
• Bonus eligibility for bonus-eligible roles, with targets based on market benchmarks and individual contributions.
• For benefits-eligible roles, a comprehensive benefits package covering health, retirement, and wellbeing, with optional benefits to meet employees’ diverse needs.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior