Lead, Vulnerability & Exposure Management

Summary

Lead, Vulnerability & Exposure Management - Hybrid in NYC or Fort Worth, TX (FTE/Direct-hire)

Optomi, in partnership with a global PE firm, is hiring a Lead Vulnerability & Exposure Management to help mature and lead a growing enterprise vulnerability management program for a global financial services organization.

Location: New York, NY or Fort Worth, TX

This is a high-impact opportunity for someone who wants to go beyond traditional vulnerability scanning and reporting. The team is looking for a hands-on security leader who can take a vulnerability from identification through validation, risk analysis, attack-path assessment, and remediation follow-through.

The environment is currently earlier in its vulnerability management maturity journey, so this person will have the opportunity to significantly influence how the program evolves.

What you'll be responsible for:

• Own and mature the vulnerability management lifecycle across endpoints, servers, networks, cloud platforms, applications, containers, and other enterprise technologies
• Validate vulnerabilities and determine real-world exploitability rather than relying solely on scanner severity
• Build the “attack story” around findings by connecting vulnerabilities to threat actors, TTPs, attack paths, and business impact
• Partner with infrastructure, network, cloud, application, and technology owners to drive remediation through closure
• Improve asset visibility, scanner coverage, data quality, and vulnerability-management processes
• Help mature exposure-management capabilities, including internal/external attack surface and attack-path analysis
• Evaluate vulnerability and exposure recommendations from platforms such as Microsoft Defender and determine what is truly actionable
• Support risk-based prioritization, risk acceptance, compensating controls, and remediation decisions when vulnerabilities cannot immediately be patched
• Monitor emerging vulnerabilities, active exploitation, threat intelligence, and evolving AI-related security risks
• Provide initial incident/security-event triage and identify when activity requires deeper investigation or escalation
• Communicate vulnerability and exposure risk clearly to both technical teams and senior leadership

What we're looking for:

• Strong background in enterprise Vulnerability Management or Exposure Management
• Experience owning vulnerabilities beyond the “scan and report” stage
• Ability to analyze exploitability, attack paths, threat activity, and business risk
• Working knowledge of Incident Response, security operations, or threat analysis
• Experience with tools such as Qualys, Tenable, Rapid7/Nexpose, Microsoft Defender Vulnerability Management, or similar platforms
• Understanding of asset-management and vulnerability-data reconciliation across enterprise environments
• Familiarity with CVSS, EPSS, CISA KEV, threat intelligence, risk acceptance, and compensating controls
• Strong communication skills and the ability to influence remediation without direct authority
• Ability to operate independently and comfortably communicate with senior leadership

This is an excellent opportunity for someone who wants to take ownership of a vulnerability program, improve its maturity, and connect vulnerability management more directly with threat intelligence, incident response, and real-world exposure.

Job Description

Lead, Vulnerability & Exposure Management - Hybrid in NYC or Fort Worth, TX (FTE/Direct-hire)

Optomi, in partnership with a global PE firm, is hiring a Lead Vulnerability & Exposure Management to help mature and lead a growing enterprise vulnerability management program for a global financial services organization.

Location: New York, NY or Fort Worth, TX

This is a high-impact opportunity for someone who wants to go beyond traditional vulnerability scanning and reporting. The team is looking for a hands-on security leader who can take a vulnerability from identification through validation, risk analysis, attack-path assessment, and remediation follow-through.

The environment is currently earlier in its vulnerability management maturity journey, so this person will have the opportunity to significantly influence how the program evolves.

What you'll be responsible for:

• Own and mature the vulnerability management lifecycle across endpoints, servers, networks, cloud platforms, applications, containers, and other enterprise technologies
• Validate vulnerabilities and determine real-world exploitability rather than relying solely on scanner severity
• Build the “attack story” around findings by connecting vulnerabilities to threat actors, TTPs, attack paths, and business impact
• Partner with infrastructure, network, cloud, application, and technology owners to drive remediation through closure
• Improve asset visibility, scanner coverage, data quality, and vulnerability-management processes
• Help mature exposure-management capabilities, including internal/external attack surface and attack-path analysis
• Evaluate vulnerability and exposure recommendations from platforms such as Microsoft Defender and determine what is truly actionable
• Support risk-based prioritization, risk acceptance, compensating controls, and remediation decisions when vulnerabilities cannot immediately be patched
• Monitor emerging vulnerabilities, active exploitation, threat intelligence, and evolving AI-related security risks
• Provide initial incident/security-event triage and identify when activity requires deeper investigation or escalation
• Communicate vulnerability and exposure risk clearly to both technical teams and senior leadership

What we're looking for:

• Strong background in enterprise Vulnerability Management or Exposure Management
• Experience owning vulnerabilities beyond the “scan and report” stage
• Ability to analyze exploitability, attack paths, threat activity, and business risk
• Working knowledge of Incident Response, security operations, or threat analysis
• Experience with tools such as Qualys, Tenable, Rapid7/Nexpose, Microsoft Defender Vulnerability Management, or similar platforms
• Understanding of asset-management and vulnerability-data reconciliation across enterprise environments
• Familiarity with CVSS, EPSS, CISA KEV, threat intelligence, risk acceptance, and compensating controls
• Strong communication skills and the ability to influence remediation without direct authority
• Ability to operate independently and comfortably communicate with senior leadership

This is an excellent opportunity for someone who wants to take ownership of a vulnerability program, improve its maturity, and connect vulnerability management more directly with threat intelligence, incident response, and real-world exposure.