Lead, Vulnerability & Exposure Management

Lead, Vulnerability & Exposure Management - Hybrid in NYC or Fort Worth, TX (FTE/Direct-hire)Optomi, in partnership with a global PE firm, is hiring a Lead Vulnerability & Exposure Management to help mature and lead a growing enterprise vulnerability management program for a global financial services organization.Location: New York, NY or Fort Worth, TXThis is a high-impact opportunity for someone who wants to go beyond traditional vulnerability scanning and reporting. The team is looking for a hands-on security leader who can take a vulnerability from identification through validation, risk analysis, attack-path assessment, and remediation follow-through.The environment is currently earlier in its vulnerability management maturity journey, so this person will have the opportunity to significantly influence how the program evolves.What you’ll be responsible for:Own and mature the vulnerability management lifecycle across endpoints, servers, networks, cloud platforms, applications, containers, and other enterprise technologiesValidate vulnerabilities and determine real-world exploitability rather than relying solely on scanner severityBuild the “attack story” around findings by connecting vulnerabilities to threat actors, TTPs, attack paths, and business impactPartner with infrastructure, network, cloud, application, and technology owners to drive remediation through closureImprove asset visibility, scanner coverage, data quality, and vulnerability-management processesHelp mature exposure-management capabilities, including internal/external attack surface and attack-path analysisEvaluate vulnerability and exposure recommendations from platforms such as Microsoft Defender and determine what is truly actionableSupport risk-based prioritization, risk acceptance, compensating controls, and remediation decisions when vulnerabilities cannot immediately be patchedMonitor emerging vulnerabilities, active exploitation, threat intelligence, and evolving AI-related security risksProvide initial incident/security-event triage and identify when activity requires deeper investigation or escalationCommunicate vulnerability and exposure risk clearly to both technical teams and senior leadershipWhat we’re looking for:Strong background in enterprise Vulnerability Management or Exposure ManagementExperience owning vulnerabilities beyond the “scan and report” stageAbility to analyze exploitability, attack paths, threat activity, and business riskWorking knowledge of Incident Response, security operations, or threat analysisExperience with tools such as Qualys, Tenable, Rapid7/Nexpose, Microsoft Defender Vulnerability Management, or similar platformsUnderstanding of asset-management and vulnerability-data reconciliation across enterprise environmentsFamiliarity with CVSS, EPSS, CISA KEV, threat intelligence, risk acceptance, and compensating controlsStrong communication skills and the ability to influence remediation without direct authorityAbility to operate independently and comfortably communicate with senior leadershipThis is an excellent opportunity for someone who wants to take ownership of a vulnerability program, improve its maturity, and connect vulnerability management more directly with threat intelligence, incident response, and real-world exposure.