Head of Vulnerability Management

Kerry Consulting; Singapore; On-site; SGD 220,000 - 320,000; Full time

Job summary

Kerry Consulting is partnering with a global client to appoint a senior cybersecurity leader to drive an enterprise Vulnerability Management capability. The role will evolve the function towards a proactive, threat-informed approach spanning cloud, on-premises, applications and identity environments.

The ideal candidate will own strategy, roadmap, governance and reporting, while building and leading a high-performing team and aligning remediation with business impact and risk.

Qualifications

• Extensive cybersecurity experience with senior leadership responsibility in vulnerability management or security assurance.
• Proven track record building or maturing an enterprise-scale vulnerability management programme.
• Strong expertise across vulnerability management, attack surface management, penetration testing and exposure validation.
• Good understanding of threat-informed prioritisation, attack paths and business-criticality-based risk assessment.
• Experience with threat intelligence, cloud security and security automation.
• Experience within financial services or another complex regulated environment preferred.
• Strong senior stakeholder management and communication skills.
• Relevant certifications such as CISSP, CISM, CRISC, SANS or OffSec would be advantageous.

Responsibilities

• Own the strategy and roadmap for enterprise vulnerability management.
• Drive continuous visibility and assessment of the organisation's attack surface across cloud, on-premises, applications and identity.
• Establish risk-based prioritisation using threat intelligence, exploitability, asset criticality and business impact.
• Oversee vulnerability scanning, penetration testing, attack-path analysis and breach/attack simulation.
• Partner with technology teams to drive remediation, address root causes and reduce recurring exposures.
• Establish vulnerability, remediation and patch-management standards and governance.
• Develop KRIs, KPIs and management reporting to track exposure and programme effectiveness.
• Leverage automation, analytics and AI to improve discovery, prioritisation and remediation.
• Partner with Technology Risk and Audit on assurance and control matters.
• Build and lead a high-performing team.

Skills

Vulnerability management

Attack surface management

Threat intelligence

Security assurance

Penetration testing

Cloud security

Stakeholder management

Communication

Job description

We are currently supporting a global client in seeking a senior cybersecurity leader to drive its enterprise Vulnerability Management capability.

The role will evolve traditional vulnerability management towards a more proactive, threat-informed approach, covering infrastructure, applications, cloud and identity environments.

Key Responsibilities:

• Own the strategy and roadmap for enterprise vulnerability management.
• Drive continuous visibility and assessment of the organisation's attack surface across cloud, on-premises, applications and identity.
• Establish risk-based prioritisation using threat intelligence, exploitability, asset criticality and business impact.
• Oversee vulnerability scanning, penetration testing, attack-path analysis and breach/attack simulation.
• Partner with technology teams to drive remediation, address root causes and reduce recurring exposures.
• Establish vulnerability, remediation and patch-management standards and governance.
• Develop KRIs, KPIs and management reporting to track exposure and programme effectiveness.
• Leverage automation, analytics and AI to improve discovery, prioritisation and remediation.
• Partner with Technology Risk and Audit on assurance and control matters.
• Build and lead a high-performing team.

Requirements:

• Extensive cybersecurity experience with senior leadership responsibility across vulnerability management, or security assurance.
• Proven experience building or maturing an enterprise-scale vulnerability management programme.
• Strong expertise across vulnerability management, attack surface management, penetration testing and exposure validation.
• Good understanding of threat-informed prioritisation, attack paths and business-criticality-based risk assessment.
• Experience with threat intelligence, cloud security and security automation.
• Experience within financial services or another complex regulated environment preferred.
• Strong senior stakeholder management and communication skills.
• Relevant certifications such as CISSP, CISM, CRISC, SANS or OffSec would be advantageous.