Senior Director, Exposure & Vulnerability Management

Define and own WTW's enterprise exposure & vulnerability management strategy and a multi-year roadmap that aligns infrastructure, cloud, application, identity and software supply chain risk into a unified risk view.

Operationalize a continuous exposure & vulnerability management lifecycle (scoping, discovery, prioritization, validation and mobilization) aligned to CTEM principles.

Track vulnerabilities via risk-based prioritization grounded in exploitability, threat intelligence, asset criticality, exposure and business impact.

Establish clear ownership models, accountability and engagement patterns with technology and engineering teams to drive timely and effective remediation.

Own the annual operating plan and budget for exposure & vulnerability management, building business cases for investment and demonstrating return in terms of risk reduction.

Ensure continuous, comprehensive discovery of exposures across on-premises, cloud technologies, endpoints, IoT, SaaS and internet-facing attack surfaces.

Partner with the Asset Management team to ensure exposure data is anchored to an accurate, authoritative asset inventory (CMDB), including ownership, business service mapping and criticality tiering.

Ensure exposure coverage includes misconfigurations, cloud posture, identity and access weaknesses, external attack surface and unmanaged or shadow assets.

Own and continuously refine WTW's risk-based vulnerability scoring and prioritization model, incorporating exploit prediction (e.g. EPSS), known-exploited intelligence (e.g. CISA KEV), threat intelligence, compensating controls and business context.

Establish exposure validation capabilities, including attack path analysis, breach and attack simulation, and coordination with penetration testing and red team functions, to confirm real-world exploitability.

Define and maintain risk-tiered remediation SLAs that differentiate by exposure, asset type and business criticality.

Lead global teams responsible for vulnerability operations, ensuring consistent, scalable execution of discovery, validation, prioritization, tracking and closure across technology domains.

Drive remediation mobilization through integrated workflows, clear hand-offs to owning teams and escalation paths for overdue or high-risk exposures.

Lead WTW's response to critical and emerging vulnerabilities (e.g. zero-days and widely exploited flaws), coordinating rapid impact assessment, executive communication and accelerated remediation with Security Operations, Incident Response and Technology.

Maintain availability for critical and emerging vulnerability events (e.g. zero-days), including participation in an on-call rotation or escalation structure to ensure rapid impact assessment and response outside of standard business hours.

Own the vulnerability risk exception and acceptance process, ensuring exceptions are risk-assessed, time-bound, approved at the appropriate level and tracked to resolution.

Partner with Application Security and Business Technology leadership to embed SAST, DAST and SCA coverage and the broader application security toolchain (e.g., secrets detection, container and infrastructure-as-code scanning) — contributing risk-based prioritization methodology and ensuring application findings feed into the same risk-ranked queue as infrastructure and cloud exposures, rather than owning the toolchain itself.

Support Application Security's efforts to embed security earlier in the SDLC by aligning exposure & vulnerability management's remediation workflow, SLAs, and reporting with their developer-friendly tooling and pipeline guardrails — extending consistent tracking and accountability to application-layer findings without taking on pipeline ownership.

Collaborate with Application Security, Business Technology, and GRC to strengthen software supply chain risk management — including open-source governance and SBOM practices — providing exposure-management visibility, prioritization, and reporting rather than owning the program.

Own the policies, standards and procedures governing vulnerability and exposure management, ensuring they are current, enforceable and consistently applied.

Ensure the program meets regulatory and contractual obligations across WTW's operating jurisdictions, including DORA, NYDFS Part 500, GDPR and relevant client and industry requirements.

Serve as the accountable lead for exposure & vulnerability management in engagements with regulators, Internal Audit, external auditors and client security assessments, and own remediation of related findings.

Partner with Enterprise Risk and the second line to align exposure metrics with WTW's cyber risk appetite, key risk indicators and risk register.

Assess and govern exposure risk introduced through acquisitions, divestitures and third-party or managed service providers.

Build and mature exposure-focused metrics and KRIs that enable leadership to understand risk posture, trends, remediation effectiveness and SLA performance.

Partner with data and analytics teams to leverage security telemetry, automation and correlation across multiple data sources.

Translate technical findings into clear, decision-ready insight for the CISO, executive leadership, risk committees and, where required, the Board.

Drive modernization of exposure & vulnerability management tooling, workflows and integrations, including consolidation and rationalization of overlapping tools.

Identify and deliver opportunities for automation, orchestration and responsible use of AI to scale prioritization, triage and remediation.

Partner with Product, Business Technology, Engineering, Cloud Operations, and Architecture teams to influence platform capabilities and security-by-design practices.

Own vendor and managed service relationships for exposure & vulnerability management, including selection, contract governance and performance management.

Lead, coach and develop high-performing teams across multiple disciplines and geographies, including managers of managers.

Design the organization, roles and career paths for the function; build succession and a strong bench of future leaders.

Foster a culture of collaboration, accountability and continuous improvement, breaking down silos between vulnerability, asset and application security teams.

Serve as a trusted advisor to Technology, Security and Risk leadership on exposure trends and remediation priorities.

Influence cross-functional stakeholders without direct authority in a complex, matrixed, global environment.