Senior Principal, Vulnerability Management

Summary

Your role in our mission

• Own the end-to-end enterprise Vulnerability Management (VM) program, including strategy, roadmap, operating model, and metrics.
• Define and maintain a risk-based vulnerability management framework aligned to NIST CSF, CIS Controls, and industry best practices.
• Establish and maintain policies, standards, and procedures for vulnerability identification, assessment, prioritization, remediation, and exception handling.
• Develop multi-year maturity plans for VM capabilities across server, endpoint, network, application, cloud, and third-party domains.
• Serve as product owner and technical authority for the Tenable platform (Tenable.sc, Tenable.io, Tenable One) across the enterprise.
• Design and maintain Tenable architecture.
• Lead design and operation of scanning strategies across Tenable.sc, Tenable.io, and Tenable One, including asset tagging, scoping, credential management, and scan frequency.
Oversee the full lifecycle from detection triage assignment remediation
• validation, ensuring timely closure of high and critical vulnerabilities.
• Operationalize risk-based prioritization using Tenable risk scores (e.g., VPR/CES) combined with business impact, exploitability, and threat intelligence.
• Partner with infrastructure, application, and cloud teams to align remediation timelines with SLAs and change management processes.
• Ensure vulnerability and configuration coverage across: Network devices (e.g., Palo Alto firewalls, Panorama, F5, Citrix/NetScaler, Riverbed), Endpoints and servers (via Tanium and SCCM), Virtualized and remote access environments (Citrix, NS).
• Integrate threat intelligence and MITRE ATT&CK mappings into vulnerability prioritization and reporting.
• Correlate vulnerabilities with active exploitation trends, threat actor TTPs, and sector-specific threats (especially healthcare/public sector).
• Inform executive and technical stakeholders on emerging vulnerabilities (e.g., zero-days, high-profile CVEs) and coordinate rapid response efforts.
• Define and track key VM metrics and KPIs (e.g., mean time to remediate by severity, SLA adherence, exception volumes, exposure trends, coverage levels).
• Produce executive-ready dashboards and reports for senior leadership, auditors, and clients.
• Support internal and external audits, regulatory assessments, and customer security due diligence as the authoritative owner of VM processes and data.
• Chair or participate in governance forums to drive accountability for remediation across infrastructure, application, and product teams.
• Provide senior technical and leadership guidance to vulnerability analysts, security engineers, and partner IT teams.
• Mentor junior leaders and technical staff on VM best practices, risk-based thinking, and program management.

What we're looking for

• 17+ years of progressive IT experience, with strong grounding in infrastructure, networking, and enterprise operations.
• 3+ years of leadership experience in complex, mission-critical environments (healthcare, public sector, and/or military strongly preferred).
• 4–7+ years of hands-on cybersecurity experience, with significant time spent building, leading, or owning vulnerability management programs.
• Proven experience designing and operating enterprise VM at scale using: Tenable.sc / Tenable.io / Tenable One (5+ years strongly preferred).
• Preferred Completion of SANS MGT516 / SANS 516 – Building and Leading Vulnerability Management Programs or equivalent leadership training in vulnerability management.
• Professional security certifications such as CISSP, GIAC (e.g., GCLD, GMON, GVAC), or equivalent are preferred.

What you should expect in this role

• This opportunity is 100% remote within the Unites States with the opportunity to travel for work up to 15% annually.

This posting is intended for pipelining. We will accept applications on an ongoing basis.