vulnerability management lead

OneMain Financial

<div><p>The Threat &amp; Vulnerability Team Manager will be leading critical support for the Information Security&rsquo;s vulnerability management program (VM) for both the on-prem &amp; cloud environments managed by One Main Financial (OMF). They will help create a robust proactive approach for preventing unauthorized access, changes, or exploitation of vulnerabilities through mitigation, active defenses, and automated responses. The VM team&rsquo;s portfolio of activities includes providing vulnerability detection and remediation oversight, vulnerability research, secure baseline compliance, web application security, host-based security, network security, and acting as security subject matter experts for all the organization.</p><p></p><p><b>
Required TVM Technical Competencies</b></p><ul><li>
Extensive knowledge and hands-on experience with a variety of Vulnerability Management Tools such as Tenable, DB Protect, Netsparker, Qualys, etc.</li><li>
Expert knowledge of the Vulnerability Management lifecycle</li><li>
Proven track record of designing, implementing, and managing a successful Threat &amp; Vulnerability Management Program</li><li>
Strong knowledge of networking, operating systems, databases, and web applications</li><li>
Strong knowledge of cybersecurity operations (Cyber Threat Intelligence, Penetration testing, &amp; Incident Response)</li><li>
Deep knowledge and experience of performing both manual and automated asset discovery and enumeration</li><li>
Deep knowledge and experience of systematic and data-driven asset prioritization</li><li>
Expert knowledge and successful application of risk management frameworks</li><li>
Required TVM Management Competencies</li><li>
Track record of leading enterprise-level vulnerability management teams with a history of increasing responsibility</li><li>
Expert project management skills</li><li>
Ability to explain vulnerability management concepts to a wide range of audiences verbally and in writing</li><li>
Expertise in developing and improving vulnerability management operations and processes</li><li>
Strong interpersonal skills and the ability to collaborate with a variety of stakeholders to ensure vulnerability management compliance</li><li>
Expert problem solving and critical thinking skills</li><li>
Proactive disposition and ability to execute on leadership vision with minimal oversight</li></ul><p></p><p><b>
Additional Responsibilities</b></p><p></p><ul><li>
Perform Project/Team Management activities, including assigning tasks, 1-1 coaching, upskilling junior team members, performance evaluations, etc.</li><li>
Lead the redesign, build and day-to-day operations of the vulnerability management (VM) team to include standardization of processes and managing customer expectations.</li><li>
Effectively manage a team of vulnerability management professionals who are focused on proactively preventing the exploitation of IT vulnerabilities that exist across the OMF environments.</li><li>
Successfully assign and complete VM projects, tasks, and\or initiatives on time and to vulnerability management standards.</li><li>
Track all team projects, tasks, and/or initiatives in a centralized location (e.g., Microsoft Lists, Jira, etc.) and provide a reportable schedule.</li><li>
Drive actionable metrics which help ensure the team reduce the time and resources needed to detect, investigate, analyze and remediate vulnerabilities.</li><li>
Manage performance of risk‐based assessments of current and emerging information security issues to support the mission by prioritizing remediation efforts.</li><li>
Proactively delegate support of regular vulnerability, compliance/configuration, database, and web application scanning.</li><li>
Apply effective problem solving and critical thinking skills to evaluate applicable solutions, conduct pilot/evaluations for proof of concepts and ultimately implement better mitigating controls.</li><li>
Research current and emerging information security exploits, threats, and vulnerabilities and disseminate contextual information to appropriate stakeholders.</li><li>
Facilitate exception handling, waiver processing and escalations as needed.</li><li>
Maintain regular communication with security leaderships on process optimization, tools tuning and resetting of VM priorities as business needs prudently recommend.</li></ul><p></p><p><b>
Minimum Qualifications</b></p><p></p><ul><li>
Bachelor's degree and 8+ years of related work experience; or a graduate degree and approximately 7-8 years of related work experience in the fields of Computer Science, Information Systems, Engineering, Business or related major</li><li>
A minimum of 6+ years of professional work experience in cybersecurity with at least 5 years in Vulnerability Management.</li><li>
3 or more years managing\supervising a team of vulnerability management professionals.</li><li>
Knowledge of general security concepts and methods such as vulnerability assessments, data classification, privacy assessments, incident response, security policy creation, enterprise security strategies, architectures, and governance.</li><li>
Experience in process definition, workflow design and process mapping</li><li>
Excellent interpersonal, written/verbal communication and leadership skills with the ability to make recommendations to all levels of the organization.</li></ul><p></p><p><i>
OneMain Holdings, Inc. is an Equal Employment Opportunity (EEO) employer. Qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship status, color, creed, culture, disability, ethnicity, gender, gender identity or expression, genetic information or history, marital status, military status, national origin, nationality, pregnancy, race, religion, sex, sexual orientation, socioeconomic status, transgender or on any other basis protected by law.</i></p></div>

Associate Director Info Security

geidea

<div>
 <p>
  Established in 2008, Geidea epitomises customer focused empowerment and commercial success through continuous innovation
 </p>
 <p>
  Geidea makes best in class digital payment solutions available for all by attracting and leveraging the best creative &amp; entrepreneurial talent in the market Our solutions give any business the chance to get ahead and reach for more no matter their size or maturity. Our technology mirrors our people - Smart, Innovative &amp; Forward Thinkiking
 </p>
 <p>
  To maintain competitive advantage as we grow, we are currently looking for a new "
  <strong>
   Cybersecurity Defense Expert"
  </strong>
 </p>
 <p>
  <br/>
 </p>
 <p>
  <strong>
   Job purpose:
  </strong>
 </p>
 <p>
  The purpose of this role is to lead the defense against cyber threats through proactive SOC Monitoring, DFIR, Threat Intelligence, and Vulnerability Management, ensuring the integrity, confidentiality, and availability of information systems in all regions.
 </p>
 <p>
  <br/>
 </p>
 <p>
  <strong>
   Key accountabilities and decision ownership:
  </strong>
 </p>
 <ul>
  <li>
   Lead and enhance SOC operations, focusing on real-time threat detection, incident response, and continuous monitoring.
  </li>
  <li>
   Coordinate digital forensics and incident response efforts to mitigate threats efficiently and reduce recovery time.
  </li>
  <li>
   Develop and implement a threat intelligence program to identify and counteract evolving cyber threat
  </li>
  <li>
   Manage the Vulnerability Management Program, including regular assessments, risk prioritization, and remediation strategies.
  </li>
  <li>
   Support the cybersecurity vision and strategy in alignment with defense operations and organizational goals.
  </li>
  <li>
   Oversee information security audits, whether by performed by organization or third-party personnel.
  </li>
  <li>
   Lead integration of standard and non-standard logs in SIEM.
  </li>
  <li>
   Create reports, dashboards, metrics for SOC operations and presentation to Senior Management.
  </li>
  <li>
   Lead team &amp; vendor management overall use of resources and initiation of corrective action where required for Security Operations Center.
  </li>
  <li>
   Develop and maintain enterprise Threat &amp; Vulnerability Management framework and necessary program operational capabilities that include identify, risk assess, and monitor of vulnerability and associated remediation.
  </li>
  <li>
   Maintain control effectiveness and continuously identify gaps in detection controls across the environment, including Geidea&rsquo;s cloud environments.
  </li>
  <li>
   Serve as the process owner of all ongoing activities related to the confidentiality, integrity and availability of information and resources of customers, business partners, employees, and business information, in compliance with the organization's Cyber and Information security policies.
  </li>
  <li>
   Evaluate team performance and build on people capabilities.
  </li>
 </ul>
 <p>
  <br/>
 </p>
 <p>
  <strong>
   Must have technical / professional qualifications:
  </strong>
 </p>
 <ul>
  <li>
   2-3 years of experience
  </li>
  <li>
   Bachelor&rsquo;s degree in computer science, Information Technology, Telecommunications, Electronics &amp; Electrical or any related field.
  </li>
  <li>
   Certifications:
  </li>
  <li>
   GCIH
  </li>
  <li>
   GCFA
  </li>
  <li>
   Experience in cybersecurity architecture design.
  </li>
  <li>
   Experience in NESA IAR, SAMA CSF, PCI-DSS, NCA is a must.
  </li>
 </ul>
 <p>
  <br/>
 </p>
 <p>
  Our values guide how we think and act - They describe what we care about the most.
 </p>
 <p>
  <strong>
   Customer first
  </strong>
  - It&rsquo;s embedded in our design thinking and customer service approach.
 </p>
 <p>
  <strong>
   Open
  </strong>
  - Openness allows us to constantly improve and evolve.
 </p>
 <p>
  <strong>
   Real
  </strong>
  - No jargon and no excuses!
 </p>
 <p>
  <strong>
   Bold
  </strong>
  - Constantly challenging ourselves and our way of thinking.
 </p>
 <p>
  <strong>
   Resilient
  </strong>
  &ndash; If we fail, we bounce back stronger than before.
 </p>
 <p>
  <strong>
   Collaborative
  </strong>
  - We know that we can achieve a lot more as a team.
 </p>
 <p>
  We are changing lives by constantly striving for a better solution.
 </p>
 <p>
  Click apply below and become part of the Geidea story
 </p>
</div>


Cybersecurity Defense Expert

Hyland

<div>Overview:
<h1 class="jobSectionHeader"><b>Manager, Enterprise Vulnerability Management</b></h1><div><b>
Location:</b> Remote - US | <b>Remote</b></div><h2 class="jobSectionHeader"><b>
About the Role</b></h2><div>
The Manager, Enterprise Vulnerability Management is responsible for the strategy, design, implementation, and continuous improvement of the enterprise-wide vulnerability management program. This role drives risk-based prioritization, remediation, and maturity of vulnerability processes across cloud, on-premises, containers, applications, endpoints, and infrastructure. This leader will manage a team of analysts and partner with security engineering, product, and leadership teams to reduce organizational risk from vulnerabilities while enabling secure and reliable operations.</div><h2 class="jobSectionHeader"><b>
Your Role Responsibilities? Here's what you'll do.</b></h2><ul><li>
Define, evolve, and execute the team-level and program execution strategy for enterprise vulnerability management aligned with business objectives <i>(e.g., SOC 2, ISO 27001, NIST)</i>, including metrics, dashboards, and continuous improvement initiatives.</li><li>
Oversee the end-to-end vulnerability management lifecycle including discovery, assessment, risk-based prioritization, remediation/mitigation, and verification using frameworks that combine technical severity with business impact.</li><li>
Partner with engineering, IT, AppSec, and cloud teams to triage vulnerabilities from scanners, penetration tests, and bug bounties &mdash; removing blockers and ensuring accountability for remediation.</li><li>
Build, document, and optimize processes for asset management, scanning, reporting, and tracking while identifying and driving automation opportunities to scale the program.</li><li>
Provide executive-level reporting on program effectiveness, risk posture, trends, and key metrics, ensuring alignment with internal policies, industry standards, and audit requirements.</li><li>
Lead, develop, and mentor a team of vulnerability management analysts, fostering accountability, personal growth, and a culture of continuous improvement.</li></ul><h2 class="jobSectionHeader"><b>
Role Essentials</b></h2><ul><li>
Bachelor's degree in computer science, information security, or equivalent experience, with 8+ years in information security and at least 3 years focused on vulnerability management</li><li>
Proven track record building, scaling, or leading a vulnerability management program in a large, complex environment <i>(multi-cloud, global, or high-scale tech/SaaS preferred)</i></li><li>
Deep knowledge of vulnerability management tools and strong understanding of asset discovery, scanning methodologies, cloud security <i>(AWS, Azure, GCP)</i>, containers, and modern infrastructure</li><li>
Knowledge of relevant frameworks: NIST, FedRAMP, CIS, OWASP, ISO 27001</li><li>
Excellent program management, leadership, and communication skills with the ability to drive complex cross-functional initiatives with measurable outcomes</li><li>
Willingness to travel up to 5% as required</li></ul><h2 class="jobSectionHeader"><b>
What We'd Like to See</b></h2><ul><li>
Relevant certifications: CISSP, CISM, CRISC, GIAC, CCSP, or vendor-specific</li><li>
Experience with automation/scripting and integration with DevOps pipelines <i>(e.g., CI/CD, ticketing systems, or orchestration tools)</i></li><li>
Demonstrated fiscal responsibility and accountability in managing budgets</li><li>
Superior ability to coach, mentor, and develop team members and identify future leaders</li><li>
Strong business and technology acumen with the ability to engage and present effectively at the executive level</li></ul><h2 class="jobSectionHeader"><b>
Pay Transparency</b></h2><div>
The salary range for this role is <b>$153,000 &ndash; $172,000</b>. The listed salary range represents a good faith estimate at the time of posting. The listed range may be adjusted in the future based on business needs. Actual compensation will be based on job-related factors including, but not limited to, qualifications, skills, and experience.</div><h2 class="jobSectionHeader"><b>
About Hyland</b></h2><div>
Hyland is the pioneer of the Content Innovation Cloud&trade;, delivering ubiquitous enterprise intelligence to organizations with solutions that unlock actionable insights and drive automation. &copy; Hyland. All rights reserved. Trusted by thousands of organizations worldwide, including many of the Fortune 100, Hyland's solutions create the foundation for a connected, agentic enterprise, where teams harness the power of AI to redefine how they operate and engage with those they serve. For additional information on Hyland's platform and services, please visit Hyland.com.</div><h2 class="jobSectionHeader"><b>
#HylandLife</b></h2><div>
#HylandLife Since 1991, it has been Hyland's mission to help our employees, customers and partners exceed their potential with our industry-leading content services platform. Our employees exude a contagious energy and are passionate about what they do &ndash; whether it's helping customers succeed, raising up their fellow Hylanders, or engaging in the communities where they live and work. The #HylandLife hashtag encompasses our employee-centric culture. Our employees live our culture day in and day out by bringing their best self to work. Hyland supports them to do just that through career development resources, wellbeing programs and innovation practices. We thrive on diverse viewpoints and new ideas and believe that a positive, inclusive workplace is imperative to sustainable success. As we've grown to a company of nearly 4,000 strong, we have the opportunity to make a significant impact on our communities. We strongly support employee initiatives and align our giving campaigns and programs to organizations that are important to them.</div><h2 class="jobSectionHeader"><b>
Equal Opportunity Statement</b></h2><div>
Hyland is an equal opportunity employer. We value diversity and are committed to providing an inclusive workplace for all employees and applicants. Employment decisions are made without regard to any characteristic protected by applicable laws and regulations. Information collected during the hiring process is used solely to assess qualifications, verify identity, and comply with legal requirements.</div></div><div></div>

Manager, Enterprise Vulnerability Management

Blue Yonder

<div><p><b>Job Title:</b><br>
IT Operations Lead &ndash; Mac Endpoint Management (Global SME) | Architect Level</p><p><b>
Location:</b><br>
Hyderabad, India</p><div></div><p><b>
Role Overview</b></p><p>
We are seeking a highly experienced IT Operations Lead with architect-level expertise in endpoint management, specializing in Mac environments alongside Windows ecosystems. This role will function as the Global SME and Single Point of Contact (SPOC) for MacBook management across the enterprise, while also leading IT operations for Hyderabad and Pune locations, including ownership of L3 support for endpoint OS and hardware.</p><p>
The ideal candidate will bring deep technical expertise in Mac endpoint architecture, enterprise management tools, and security frameworks, combined with strong operational leadership to ensure scalable, secure, and high-performing end-user computing services.</p><div></div><p><b>
Key Responsibilities</b></p><p><b>
1. Global Mac Endpoint Management &amp; Architecture</b></p><ul><li>
Serve as the Global SPOC and SME for Mac endpoint strategy, governance, and operations.</li><li>
Own the end-to-end Mac lifecycle, including provisioning, configuration, patching, compliance, and advanced troubleshooting.</li><li>
Lead enterprise-wide Mac OS upgrades and migrations, ensuring compatibility, minimal disruption, and seamless rollout.</li><li>
Drive vulnerability remediation (critical, high, and zero-day) in alignment with security SLAs and organizational risk posture.</li><li>
Architect, manage, and optimize endpoint management platforms such as Microsoft Intune, ManageEngine Endpoint Central, and JAMF.</li><li>
Define and enforce enterprise standards, configurations, and best practices for Mac endpoints globally.</li><li>
Drive automation, scalability, and continuous improvement in endpoint management processes.</li><li>
Collaborate with global IT and Security teams to standardize Mac management practices and ensure compliance.</li><li>
Track and report endpoint health, compliance, and patching metrics to leadership stakeholders.</li><li>
Develop documentation and enable knowledge transfer to mitigate single points of dependency.</li></ul><div></div><p><b>
2. IT Operations Leadership (Hyderabad &amp; Pune)</b></p><ul><li>
Act as the IT Location Lead for Hyderabad, with oversight of Pune operations.</li><li>
Own end-to-end IT service delivery, ensuring SLA/OLA adherence and high user satisfaction.</li><li>
Provide L3-level expertise for Mac and Windows OS, endpoint performance, and hardware issues.</li><li>
Serve as the escalation point for critical incidents, driving timely resolution and root cause analysis.</li><li>
Manage vendor engagements for hardware support, repairs, and escalations.</li><li>
Lead ITIL-aligned processes across Incident, Problem, and Change Management.</li><li>
Monitor and enhance service delivery metrics (SLAs, resolution time, CSAT).</li><li>
Ensure operational readiness for onboarding, expansions, and infrastructure changes.</li><li>
Align with global IT teams to maintain standardized support models across regions.</li></ul><div></div><p><b>
3. IT Asset Lifecycle Management</b></p><ul><li>
Own the complete lifecycle of IT assets, including procurement, allocation, inventory tracking, recovery, and disposal.</li><li>
Manage purchase requisitions and ensure timely procurement and approvals.</li><li>
Maintain accurate inventory and compliance of endpoint assets and peripherals.</li></ul><div></div><p><b>
4. Leadership, Stakeholder Management &amp; Collaboration</b></p><ul><li>
Partner with Global IT, Security, and Infrastructure teams to drive enterprise initiatives.</li><li>
Act as a key contributor to global endpoint security and compliance programs.</li><li>
Support leadership visits and ensure seamless IT setup for corporate events and engagements.</li></ul><div></div><p><b>
Required Skills &amp; Experience</b></p><ul><li>
Strong hands-on expertise in Mac endpoint management (mandatory)</li><li>
Experience with Microsoft Intune and ManageEngine Endpoint Central</li><li>
Proficiency in package creation, testing, and deployment for vulnerability remediation (including zero-day threats)</li><li>
Strong L3 troubleshooting capabilities across OS and hardware</li><li>
Solid understanding of endpoint security, compliance, and vulnerability management</li><li>
Working knowledge of ITIL processes (Incident, Problem, Change Management)</li><li>
Strong communication and stakeholder management skills</li></ul><div></div><p><b>
Preferred Qualifications</b></p><ul><li>
Certifications in JAMF, Apple, Microsoft Intune, or Endpoint Management</li><li>
Experience managing enterprise-scale Mac environments (Apple Business Manager, lifecycle automation)</li><li>
Exposure to scripting/automation (Shell, PowerShell)</li><li>
Experience leading OS upgrades and migration programs</li><li>
Knowledge of security frameworks and compliance standards</li><li>
Strong documentation and knowledge transfer capabilities</li></ul><p></p><p><b>
Our Values</b></p><p><br>
If you want to know the heart of a company, take a look at their values. Ours unite us. They are what drive our success &ndash; and the success of our customers. Does your heart beat like ours? Find out here: Core Values</p><p></p><p>
All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or protected veteran status.</p></div>

Team Lead, ITG

cFocus Software Incorporated

<div><h1 class="jobSectionHeader"><b>Vulnerability Analyst II &ndash; Job Description</b></h1><b>
Position Title: </b>Vulnerability Analyst II<br>
<b>Program: </b>SBA Enterprise Cybersecurity Services (ECS)<h2 class="jobSectionHeader"><b>
Position Summary</b></h2>
The Vulnerability Analyst II provides cybersecurity risk, vulnerability management, and compliance support services in alignment with the SBA Enterprise Cybersecurity Services (ECS) RFQ Task Area 3.5.2. The position supports the SBA Risk Management Framework (RMF), FISMA compliance initiatives, Information System Continuous Monitoring (ISCM), vulnerability management, controls assessment activities, audit support, and continuous monitoring operations across enterprise systems and cloud environments. The analyst performs vulnerability assessments, supports POA&amp;M development, validates security controls, coordinates remediation efforts, and assists Information System Security Officers (ISSOs) and system owners with maintaining compliant and secure systems.<h2 class="jobSectionHeader"><b>
Essential Duties and Responsibilities</b></h2><ul><li>
Perform enterprise vulnerability assessments and compliance scans using SBA-approved tools such as Tenable Security Center (SC), Nessus, and Microsoft TVM.</li><li>
Review identified vulnerabilities, assess impact and risk, and provide remediation recommendations for operating systems, applications, network devices, and cloud environments.</li><li>
Support continuous monitoring and Risk Management Framework (RMF) activities in accordance with NIST SP 800-37, NIST SP 800-53 Rev. 5, and NIST SP 800-53A.</li><li>
Assist with the creation, maintenance, and review of cybersecurity documentation including System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&amp;Ms), Configuration Management Plans (CMPs), and contingency documentation.</li><li>
Support control assessments and validation activities by documenting NIST 800-53A Determine If Statements (DISs) and mapping vulnerabilities to applicable controls.</li><li>
Conduct vulnerability scanning activities every 72 hours across workstations, servers, routers, switches, and cloud-based assets in accordance with SBA requirements.</li><li>
Monitor CISA Known Exploited Vulnerabilities (KEV) listings and Binding Operational Directives (BODs) to identify and report emerging risks.</li><li>
Track zero-day vulnerabilities, coordinate remediation activities, and provide ad hoc reporting to leadership and stakeholders.</li><li>
Generate weekly vulnerability reports, dashboards, and briefing materials for ISSOs, system owners, and management.</li><li>
Assist with audit preparation and support activities involving IG, GAO, internal auditors, and external assessors.</li><li>
Maintain scanning infrastructure including scanner deployment, configuration, plugin updates, scan repositories, and vulnerability management SOPs.</li><li>
Support FedRAMP Continuous Monitoring (CONMON) activities by reviewing vulnerability reports and assessing vendor remediation activities.</li><li>
Participate in change management, security operations meetings, and enterprise cybersecurity coordination activities.</li><li>
Ensure all deliverables are complete, accurate, aligned with agency templates, and delivered within required timeframes.</li></ul><h2 class="jobSectionHeader"><b>
Minimum Qualifications</b></h2><ul><li>
Bachelor&rsquo;s degree in Cybersecurity, Information Technology, Computer Science, Information Assurance, or related discipline. Additional years of experience may substitute for degree requirements.</li><li>
3&ndash;6 years of experience supporting vulnerability management, cybersecurity compliance, RMF, or information assurance activities in a federal environment.</li><li>
Experience performing vulnerability assessments and remediation activities using Tenable SC/Nessus or equivalent tools.</li><li>
Knowledge of FISMA, NIST RMF, NIST SP 800-53 Rev. 5, NIST SP 800-53A, NIST SP 800-137, and related federal cybersecurity standards.</li><li>
Experience supporting POA&amp;M management, security assessments, continuous monitoring, and audit response activities.</li><li>
Working knowledge of Windows, Linux/Unix, network infrastructure, cloud platforms, and enterprise security technologies.</li><li>
Strong written and verbal communication skills with the ability to produce technical documentation and executive-level reports.</li><li>
Ability to analyze security findings, prioritize risks, and coordinate remediation with technical stakeholders.</li></ul><h2 class="jobSectionHeader"><b>
Preferred Certifications</b></h2><ul><li>
CompTIA Security+</li><li>
Certified Information Systems Security Professional (CISSP)</li><li>
Certified Ethical Hacker (CEH)</li><li>
GIAC Security Certifications (GSEC, GPEN, or similar)</li><li>
Tenable Certified Professional or equivalent vulnerability management certification</li></ul><p>
</p><p>Gupkg0JOaj</p></div>

SBA - Vulnerability Analyst II

Riyadh Air

<div>About the Company:
<p>
Riyadh Air (RX), headquartered in the Saudi Capital, is the new national airline that&rsquo;s shaping the future of flying. It seeks to lead the aviation industry by transforming Saudi Arabia into a global aviation and trade hub &ndash; a digitally native airline that will connect the kingdom to more than 100 destinations.</p>
About the Role:
<p>
Do you have the technical depth and leadership drive to strengthen cybersecurity resilience for a next‑generation global airline?</p><p><br>
We&rsquo;re looking for a highly skilled individual to lead Riyadh Air&rsquo;s cybersecurity assurance and offensive security capabilities by proactively identifying, validating, and reducing cyber risk across the organisation.</p><p><br>
In this role, you&rsquo;ll lead vulnerability assessments, penetration testing, red team operations, and threat modelling across network, application, cloud, and infrastructure environments.</p><p><br>
</p><p>You&rsquo;ll work closely with SOC, DFIR, technology, and engineering teams to embed security into system design, delivery pipelines, and operational processes.</p><p><br>
</p><p>In addition, you'll be both strategic and hands‑on, equally comfortable leading programmes and deep‑diving into technical assessments.</p><p><br>
Importantly, you will turn technical findings into action by driving remediation, improving detection capabilities, enforcing security requirements within SDLC and CI/CD pipelines, and ensuring assurance activities meet regulatory and industry standards.</p><p><i><br>
Join us in shaping a secure foundation for the future of air travel; where proactive defence meets innovation, and trust is built by design.</i></p>
About You:
<p>
Degree qualified, you are expected to demonstrate 7+ years of relevant experience in offensive security, penetration testing, or cybersecurity assurance, with a deep understanding of threat modelling, vulnerability management, and secure SDLC practices.</p><p><br>
We&rsquo;d love to hear from you even more if you have a strong track record in offensive security, cybersecurity assurance, and technical risk management, ideally within large, regulated or complex environments.</p><p></p><p><br>
This is your opportunity to help protect and shape the future of air travel. Bring your expertise and show us why you can own this position within Riyadh Air.</p><p></p><p><br>
Please submit your application by clicking on the Apply button. Our Talent Acquisition team will be reviewing applications shortly.</p></div>

Cybersecurity Assurance Manager

PetroApp

<p></p><div>About PetroApp<p>
PetroApp is building a modern technology platform, helping customers and partners move faster with confident, reliable systems. As we scale our engineering organization, we&rsquo;re investing in both world-class reliability and pragmatic, high-impact security.</p><p></p>
The Role<p>
We&rsquo;re hiring a Security Lead with a strong DevOps/SRE background to build and lead our security practice while remaining hands-on across cloud infrastructure, CI/CD, and production reliability.</p><p>
You&rsquo;ll own the security strategy across the SDLC and production environment, embed security into developer workflows, lead vulnerability management and penetration testing with external vendors, and work closely with our Platform/DevOps/SRE team to ensure PetroApp&rsquo;s systems are both secure and reliable.</p><p></p>
What You&rsquo;ll DoSecurity Leadership &amp; Strategy<ul><li>
Own the overall security roadmap and strategy for PetroApp, aligning it with business and product priorities.</li><li>
Act as the primary security point of contact for engineering and leadership.</li><li>
Define, document, and maintain security policies, standards, and guidelines for engineering teams.</li><li>
Lead risk assessments, threat modeling, and security design reviews for major initiatives.</li><li>
Define and track key security KPIs and report status, risks, and progress to leadership.</li></ul>
DevSecOps &amp; SDLC Security<ul><li>
Embed security into the SDLC by integrating SAST, DAST, dependency and container scanning, and IaC scanning into CI/CD pipelines.</li><li>
Establish secure coding practices and patterns; provide guidance and reviews for high-risk changes.</li><li>
Set up and maintain secrets management and secrets detection across repos and environments.</li><li>
Drive vulnerability management: triage findings, prioritize remediation, track SLAs, and verify fixes.</li><li>
Partner with engineers to ensure security controls are automated and developer-friendly.</li></ul>
Cloud &amp; Platform Security (with SRE Mindset)<ul><li>
Own and continuously improve the cloud and platform security posture (IAM, networking, encryption, key management, hardening).</li><li>
Design and enforce least privilege access models and secure-by-default infrastructure baselines.</li><li>
Ensure security is built into core platform components such as Kubernetes, service-to-service communication, and data stores.</li><li>
Collaborate with SRE/DevOps on secure, resilient architectures, covering scalability, failover, and disaster recovery.</li></ul>
Reliability &amp; Incident Collaboration<ul><li>
Collaborate with SRE/DevOps to maintain high availability and reliability of production systems.</li><li>
Contribute to observability and monitoring with a security lens: actionable alerts, meaningful logging, and traceability.</li><li>
Participate in incident response for security-related events, including root cause analysis and long-term fixes.</li><li>
Help improve on-call and incident processes where security and reliability intersect.</li></ul>
External Security Engagements &amp; Enablement<ul><li>
Own relationships with external security vendors, including penetration testing and security assessments.</li><li>
Scope, coordinate, and manage penetration tests; track findings through to remediation and retesting.</li><li>
Coordinate security-related input for audits, certifications, and customer security questionnaires as needed.</li><li>
Run security awareness and training initiatives tailored to engineers and operational teams.</li></ul><p></p><b><br>
Requirements</b><br>
<br>
What We&rsquo;re Looking For (Must-Have)<ul><li>
5+ years of experience across DevOps/SRE/Platform Engineering and application/infrastructure security, with at least 2&ndash;3 years as a primary security owner or lead.</li><li>
Proven experience leading or owning security in a cloud-native, product-focused company.</li><li>
Strong DevOps/SRE background: operating production workloads, on-call experience, CI/CD ownership, automation, and infrastructure-as-code.</li><li>
Deep understanding of cloud security fundamentals (AWS/GCP): IAM, networking, encryption, logging, monitoring.</li><li>
Hands-on experience integrating security tooling into CI/CD pipelines (SAST, DAST, dependency scanning, container/IaC scanning).</li><li>
Solid Linux and networking fundamentals; comfortable debugging complex production and security issues.</li><li>
Experience with containers and orchestration (Docker/Kubernetes) and securing them in production.</li><li>
Practical knowledge of OWASP Top 10, common attack vectors, and secure coding principles.</li><li>
Experience managing penetration tests and/or security assessments, including scoping, coordination, and remediation follow-up.</li><li>
Excellent communication and stakeholder management skills&mdash;able to influence and drive change without blocking delivery.</li></ul><p></p>
Nice to Have<ul><li>
Experience building or operating within security frameworks/compliance programs (e.g., ISO 27001, SOC 2, PCI) relevant to PetroApp&rsquo;s domain.</li><li>
Exposure to WAF, API security, service mesh security, and zero trust patterns.</li><li>
Experience with SIEM/SOAR, security analytics, and detection engineering concepts.</li><li>
Hands-on involvement in bug bounty programs or coordinated vulnerability disclosure processes.</li><li>
Coding ability in at least one backend language (e.g., Python, Go, Node.js, Java) to build security tooling and automation.</li><li>
Experience mentoring or managing engineers with a focus on security and platform engineering.</li></ul><br>
<b>
Benefits</b><br>
<p></p><ul><li>
You will own and shape the security function in a high-impact, hands-on lead role.</li><li>
You&rsquo;ll work at the intersection of security, reliability, and platform engineering, directly influencing how PetroApp scales.</li><li>
Opportunity to work with a modern tech stack and a team that values pragmatism, automation, and continuous improvement.</li><li>
A culture that cares about doing the right thing for customers and partners, with leadership support for investing in security and reliability.</li></ul></div>

Security Lead

Search 10000+ Vulnerability management lead jobs near you this May. New roles added regularly across leading industries. Apply today.