Vice President, AI Vulnerability Operations

Mastercard•O'fallon, MO

2d•$212,000 - $339,000•Onsite

About The Position

We are transforming vulnerability management for the AI era. Frontier models and agentic systems are changing the speed, scale, and economics of vulnerability discovery, creating new defensive opportunities and operational demands. This role leads the organization responsible for turning AI-discovered vulnerabilities into measurable enterprise risk reduction. As Vice President, AI Vulnerability Operations, you will lead the enterprise AI-Powered Vulnerability Command Center, owning strategy, operating model, governance, and global execution for continuous vulnerability detection and response. You will build a high-performing organization that integrates AI-driven detection, triage, prioritization, and coordinated response across development and runtime environments, connecting technical findings to accountable remediation across engineering, infrastructure, platform, application security, risk, and business teams. This is a senior leadership role for someone who can set enterprise direction, scale operating discipline, influence senior stakeholders, and drive outcomes through teams. The VP will lead the charge to make AI Vulnerability Operations a durable, trusted, measurable function embedded into how the company manages technology risk. The mandate is to move beyond experimentation and establish a 24/7 command center capability that continuously identifies exploitable risk, accelerates decisions, coordinates response across regions and platforms, and gives leadership clear visibility into exposure, remediation progress, and risk reduction.

Requirements

15+ years in cybersecurity, technology risk, vulnerability management, application security, security operations, incident response, or related enterprise security leadership roles.
Experience leading large-scale security or technology risk functions with accountability for strategy, execution, operating discipline, metrics, governance, and stakeholder outcomes.
Strong understanding of vulnerability management, application security, cloud security, software supply-chain risk, remediation operations, continuous detection, response coordination, and enterprise risk prioritization.
Demonstrated ability to operationalize emerging capabilities, including AI, automation, analytics, command center operations, or advanced security tooling, into repeatable enterprise processes.
Executive communication skills, with the ability to translate complex technical risk into clear priorities, decisions, operating expectations, and tradeoffs.
Strong cross-functional influence with engineering, infrastructure, product, security, risk, audit, legal, sourcing, regional, platform, and business stakeholders.

Nice To Haves

Experience leading vulnerability management, product security, application security, security operations, PSIRT, or software supply-chain security in a large enterprise.
Experience using AI, machine learning, automation, or agentic workflows to improve security operations, vulnerability discovery, triage, or remediation.
Background in a regulated, high-assurance environment such as financial services, payments, government, healthcare, or critical infrastructure.
Familiarity with CVSS, EPSS, KEV, OWASP, MITRE ATT&CK, NIST, secure software development practices, and software supply-chain risk frameworks.
Track record building new enterprise capabilities, influencing senior stakeholders, and improving measurable risk outcomes across complex organizations.

Responsibilities

Set the enterprise strategy for AI Vulnerability Operations and the AI-Powered Vulnerability Command Center, including scope, priorities, governance, operating principles, global execution model, and success measures.
Define how AI-discovered vulnerabilities move from detection to validation, triage, risk prioritization, ownership assignment, coordinated response, remediation, exception handling, and verified closure.
Establish the organizational model, decision rights, escalation paths, service levels, and 24/7 operating cadence required to operate at enterprise scale.
Prioritize coverage across critical services, externally exposed assets, high-risk applications, development and runtime environments, third-party and open-source components, cloud environments, and other material technology risk areas.
Build, lead, and develop a multidisciplinary organization spanning command center operations, technical program management, vulnerability operations, security engineering, automation, analytics, and remediation coordination.
Drive operational excellence through clear intake, triage, prioritization, case management, remediation tracking, reporting, quality control, and rapid decision-making.
Turn model-generated signal into accountable action while managing false positives, duplicate findings, noise, escalation paths, and remediation fatigue.
Develop leaders and managers, establishing a culture of urgency, discipline, technical credibility, global coordination, and partnership with engineering teams.
Lead AI-enabled discovery and continuous vulnerability detection across source code, open-source dependencies, infrastructure-as-code, cloud configurations, applications, services, development and runtime environments, and enterprise platforms.
Partner with security architecture, application security, product security, platform engineering, infrastructure, regional technology teams, and technology leadership to embed AI vulnerability operations into delivery, monitoring, incident response, and remediation workflows.
Oversee standards for validation, severity calibration, exploitability assessment, reachability analysis, prioritization, remediation guidance, and closure verification.
Translate command center performance into executive-level risk narratives, metrics, investment priorities, and decision points.
Establish dashboards and reporting that show exposure, coverage, detection volume, triage outcomes, remediation performance, aging risk, exceptions, and progress against enterprise priorities.
Serve as a senior escalation point for major vulnerability campaigns, systemic risk themes, coordinated response actions, remediation blockers, and ownership challenges.
Represent the function with senior technology, security, risk, audit, legal, sourcing, business, regional, and platform stakeholders.

Benefits

insurance (including medical, prescription drug, dental, vision, disability, life insurance)
flexible spending account and health savings account
16 weeks of new parent leave
up to 20 days of bereavement leave
80 hours of Paid Sick and Safe Time
25 days of vacation time
5 personal days
10 annual paid U.S. observed holidays
401k with a best-in-class company match
deferred compensation for eligible roles
fitness reimbursement or on-site fitness facilities
eligibility for tuition reimbursement