Director of Vulnerability and Exploits

Career Techniques; Dallas (TX); Hybrid; USD 180,000 - 240,000; Full time

Job summary

Career Techniques seeks a senior leader to drive Vulnerability & Exploits. You will head a team of specialists across vulnerability management and exploit research, shaping standards and research direction.

Own the end-to-end program, from asset coverage to remediation tracking, while delivering context-aware risk models and actionable guidance for production environments. You will collaborate with Infrastructure, Platform Engineering, and Network teams to ensure secure-by-default practices and

Qualifications

• 8+ years in vulnerability research or exploit development with leadership experience
• Hands-on reverse engineering and PoC development
• Experience with enterprise assessment platforms, CVSS/EPSS, KEV, and risk-based prioritization
• Proven ability to innovate risk measurement models and prioritization frameworks

Responsibilities

• Lead and grow a team of vulnerability and exploit specialists, setting ownership and standards
• Own end-to-end vulnerability management across the full infrastructure footprint
• Direct an exploit research function to reverse-engineer exploits and build PoCs
• Develop context-aware risk models beyond CVSS and validate against real findings
• Prioritize maintenance and remediation by exploitability and operational impact
• Build research capabilities to understand vulnerability/exploit impact on production stacks
• Collaborate with Infrastructure, Platform Engineering, and Network teams for remediation
• Drive tooling strategy and deployment for vulnerability assessment and exploit research
• Develop program metrics and dashboards for visibility into exposure and remediation velocity
• Stay ahead of vulnerabilities in GPU clusters, HPC, firmware, AI workloads, and CI/CD/supply chain
• Collaborate with Threat Intelligence, Incident Response, and Offensive Security teams
• Represent the function in cross-functional reviews and leadership briefings

Skills

Vulnerability research leadership

Exploit development

Risk modeling

Cross-functional collaboration

Program management

Threat intelligence collaboration

Education

Bachelor’s degree in Engineering/CS or related field

Job description

RESPONSIBILITIES

• Lead and grow a team of vulnerability and exploit specialists across both vulnerability management and exploit research, establishing clear ownership, technical standards, research direction, and development paths.


• Own the end-to-end vulnerability management program across full infrastructure footprint: asset coverage, continuous assessment, triage, risk-based prioritization, remediation tracking, and SLA enforcement.


• Direct an exploit research function that goes beyond cataloging CVEs: reverse-engineer exploits and proof-of-concept code to understand true exploitability, build PoCs against the firm\'s own systems, and model adversarial scenarios relevant to HPC and AI environments.


• Innovate how the program measures risk. Move beyond raw CVSS to context-aware models that account for exploitability (EPSS, KEV, weaponization signals), reachability, blast radius, and impact to production workloads, and validate those models against real findings.


• Develop new approaches to prioritizing maintenance and remediation, framing patch and mitigation decisions around demonstrated exploitability and operational impact so engineering teams spend effort where it measurably reduces risk.


• Build the research capability to understand vulnerability and exploit impact to production: how a given class of flaw behaves in specific stack, what compensating controls actually hold, and where standard guidance does not fit a bare-metal HPC environment.


• Partner closely with Infrastructure, Platform Engineering, and Network teams to drive effective remediation and embed secure-by-default practices, giving engineers clear, well-contextualized, and actionable guidance.


• Drive tooling strategy and investment for the function, evaluating and deploying vulnerability assessment, management, and exploit research platforms appropriate to scale, with a bias toward depth and customization over off-the-shelf reporting.


• Develop and maintain program metrics, dashboards, and reporting cadences that give the VP of Security Operations clear visibility into exposure, remediation velocity, exploitability-weighted risk, and program maturity.


• Stay ahead of the evolving vulnerability and exploit landscape, particularly across GPU clusters, HPC interconnects, firmware and BMC/DRAC, AI workloads, and the CI/CD and supply chain, and fold emerging threats into research and program priorities.


• Collaborate with the Threat Intelligence, Incident Response, and Offensive Security teams so that vulnerability and exploit findings inform detection, response, and adversary modeling across the security organization.


• Represent the Vulnerability and Exploits function in cross-functional security reviews, risk forums, and leadership briefings, communicating program status and risk posture with clarity and precision.

REQUIREMENTS

• 8+ years of experience in vulnerability research, offensive security, or exploit development, with at least 3 years in a people management or team leadership role.


• Deep, hands-on technical expertise in vulnerability analysis and exploit research: reverse engineering, proof-of-concept development, and understanding root cause and exploitability rather than consuming scanner output.


• Strong command of vulnerability management at scale, including enterprise assessment platforms, CVSS and EPSS, KEV, and risk-based prioritization methodologies, with the judgment to know where those standards fall short and improve on them.


• Demonstrated ability to innovate: developing new risk-measurement models, prioritization frameworks, or research methods, not just operating an existing program.


• Experience securing large-scale infrastructure environments; familiarity with the vulnerability landscape of HPC, GPU clusters, high-speed interconnects, firmware, or AI workloads is a strong advantage.


• Proven ability to build and lead high-performing technical teams, including hiring, mentoring, and developing practitioners across a range of seniority levels.


• Strong cross-functional collaboration skills, with a track record of working with infrastructure and engineering teams to drive remediation outcomes and embed secure-by-default practices.


• Experience defining and operating program metrics, SLAs, and executive reporting, with the ability to communicate risk posture clearly to technical and non-technical stakeholders.


• Familiarity with vulnerability disclosure standards, the CVE process, and coordinated disclosure practices, and the ability to navigate them responsibly.


• Analytical, structured, and inventive, able to run a broad program across many asset classes while retaining the technical depth to engage meaningfully with complex exploit research.


• Bachelor’s degree in Engineering, Computer Science, or a related field, or equivalent experience