Technology Director

Wells Fargo Bank•Iselin, NJ

2d•Onsite

About The Position

Wells Fargo is seeking a Technology Director to lead vulnerability management and application security within Wealth and Investment Management Technology (WIMT). The role provides strategic direction for a proactive, scalable, risk-based approach to identifying, prioritizing, remediating, validating, and preventing vulnerabilities across applications, infrastructure, cloud, containers, open-source software, and hybrid technology environments. The Technology Director will lead a federated operating model that combines centralized vulnerability-management strategy, governance, standards, data, reporting, and enablement with accountability across technology and product organizations. The role partners across Technology, Cybersecurity, Risk, Audit, Product, Engineering, Infrastructure, and other stakeholders to strengthen ownership, governance, engineering practices, and measurable risk reduction. The leader will advance secure software development, DevSecOps, automation, authoritative vulnerability data, reusable remediation approaches, and responsible AI use. Success is measured by reduced vulnerability exposure, risk-based remediation, validated fixes, prevention of recurring vulnerabilities, stronger ownership and accountability, and scalable, effective vulnerability-management practices. The position is based at one of the listed Wells Fargo locations: Iselin, New Jersey; Charlotte, North Carolina; Minneapolis, Minnesota; or Saint Louis, Missouri.

Requirements

10+ years of Technology Strategic Leadership experience, or equivalent demonstrated through work experience, training, military experience, education, or a combination.
4+ years of management or leadership experience.
5+ years leading a large-scale vulnerability management, Application Security, cyber risk, security engineering, or closely related technology function.
5+ years of experience with Application Security, secure software development lifecycle practices, DevSecOps, and risk-based vulnerability prioritization and remediation.
5+ years leading significant technology or cybersecurity transformation, including changes to operating models, accountability, processes, engineering practices, data, or technology capabilities.
5+ years leading horizontally through influence in a complex matrixed organization and driving outcomes across organizations outside direct reporting lines.
5+ years partnering with and influencing senior Technology, Cybersecurity, Risk, Audit, Product, Engineering, Infrastructure, and business stakeholders.
5+ years translating technology and business requirements into enterprise capabilities, technology strategies, platforms, or operating-model improvements.
5+ years establishing transparent management reporting, authoritative data, meaningful metrics, and executive-level risk views that enable decisions, accountability, and measurable outcomes.
5+ years developing technology talent, building organizational capabilities, and communicating complex technology and cybersecurity risks to senior leadership.

Nice To Haves

Experience leading vulnerability management or Application Security within a large, complex, highly regulated financial services organization.
Advanced knowledge of secure SDLC, secure-by-design principles, DevSecOps, threat modeling, SAST, DAST, SCA, penetration testing, software supply-chain security, and modern application architectures.
Experience establishing federated vulnerability-management, security-champion, or similar technology-risk and engineering-enablement models.
Experience implementing threat-informed and business-contextual vulnerability prioritization and translating technical findings into meaningful business and technology risk.
Experience developing executive vulnerability reporting that connects exposure with applications, criticality, ownership, remediation commitments, aging, dependencies, and systemic risk.
Experience establishing authoritative vulnerability data and consolidating fragmented reporting, tooling, governance, and manual operational processes.
Experience developing automated or self-service capabilities supporting vulnerability remediation, validation, evidence collection, prioritization, reporting, and reusable remediation patterns.
Experience influencing enterprise cybersecurity, technology, or engineering capabilities and roadmaps and applying automation or AI to improve cybersecurity, secure development, or engineering productivity.
Demonstrated ability to challenge established processes, remove organizational friction, influence senior stakeholders, and lead sustained change across organizational boundaries.

Responsibilities

Set and execute strategic direction for vulnerability management and application security across WIMT, emphasizing proactive risk reduction, prevention, engineering enablement, and measurable outcomes.
Serve as a senior change agent, driving transparency, accountability, consistent execution, and sustainable improvement across CIO and technology organizations.
Lead a federated, risk-based operating model across applications, infrastructure, data centers, cloud, containers, platforms, open-source software, and other technology environments, with clear governance, decision rights, ownership, and escalation.
Establish an authoritative view of vulnerability exposure and remediation performance, providing leaders with actionable insight into risk, ownership, aging, dependencies, commitments, systemic issues, and areas requiring intervention.
Represent WIMT in shaping enterprise vulnerability-management and application-security capabilities, influencing strategy, tooling, data, processes, and roadmaps, and driving appropriate WIMT capabilities where gaps exist.
Shift vulnerability management toward an engineering-enablement model through actionable data, automation, self-service capabilities, reusable remediation patterns, standards, and preventative controls.
Provide strategic leadership for Application Security and secure software delivery, including secure SDLC, DevSecOps, SAST, DAST, SCA, penetration testing, threat modeling, software supply-chain risk, and earlier integration of security into engineering practices.
Drive risk-based prioritization, remediation, validation, root-cause analysis, and risk decisions using exploitability, business impact, asset and application criticality, production exposure, threat intelligence, and control effectiveness.
Partner with and influence senior Technology, Cybersecurity, Risk, Audit, Product, Engineering, and Infrastructure leaders to address material vulnerabilities, systemic risks, control issues, dependencies, and remediation commitments.
Drive continuous improvement through automation, AI, authoritative data, simplified processes, reusable solutions, and talent development, reducing manual work and recurring vulnerabilities.
Create transparency across WIMT so leaders and accountable technology owners have a consistent, trusted understanding of exposure, ownership, remediation commitments, systemic risks, and intervention needs.
Hold technology and product organizations accountable for remediation outcomes while providing centralized strategy, governance, standards, data, reporting, enablement, and appropriate escalation.
Build an organization capable of supporting increasing Application Security, cloud, DevSecOps, automation, data, and AI-related demands while maintaining appropriate governance and human oversight.
Develop high-performing technology and cybersecurity talent and represent WIMT effectively with senior internal stakeholders and relevant control or regulatory partners.