Lead, Vulnerability & Exposure Management

Optomi; New York (NY); Hybrid; USD 140,000 - 190,000; Full time

Job summary

Optomi is seeking a Lead Vulnerability & Exposure Management to mature and lead a global enterprise program. The role is hybrid with NYC or Fort Worth, TX as clear locations, offering impact across endpoints, servers, cloud, and applications.

The leader will connect vulnerability findings to threat actors, routes of attack, and business impact. Ideal candidates bring hands-on experience in vulnerability and exposure management, incident response, and security operations, with strong

Qualifications

• Experience in enterprise vulnerability management or exposure management.
• Ability to analyze exploitability, attack paths, threat activity, and business risk.
• Strong communication skills and the ability to influence remediation without direct authority.
• Experience with security operations or threat analysis.

Responsibilities

• Own and mature the vulnerability management lifecycle across endpoints, servers, networks, cloud platforms, applications, containers, and other enterprise technologies.
• Validate vulnerabilities and determine real-world exploitability rather than relying solely on scanner severity.
• Build the “attack story” around findings by connecting vulnerabilities to threat actors, TTPs, attack paths, and business impact.
• Partner with infrastructure, network, cloud, application, and technology owners to drive remediation through closure.
• Improve asset visibility, scanner coverage, data quality, and vulnerability-management processes.
• Help mature exposure-management capabilities, including internal/external attack surface and attack-path analysis.
• Evaluate vulnerability and exposure recommendations from platforms such as Microsoft Defender and determine what is truly actionable.
• Support risk-based prioritization, risk acceptance, compensating controls, and remediation decisions when vulnerabilities cannot immediately be patched.
• Monitor emerging vulnerabilities, active exploitation, threat intelligence, and evolving AI-related security risks.
• Provide initial incident/security-event triage and identify when activity requires deeper investigation or escalation.
• Communicate vulnerability and exposure risk clearly to both technical teams and senior leadership.

Skills

Vulnerability Management

Exposure Management

Threat Intelligence

Incident Response

Security Operations

Executive communication

Tools

Qualys

Tenable

Rapid7/Nexpose

Microsoft Defender Vulnerability Management

Job description

Lead, Vulnerability & Exposure Management - Hybrid in NYC or Fort Worth, TX (FTE/Direct-hire)

Optomi, in partnership with a global PE firm, is hiring a Lead Vulnerability & Exposure Management to help mature and lead a growing enterprise vulnerability management program for a global financial services organization.

Location: New York, NY or Fort Worth, TX

This is a high-impact opportunity for someone who wants to go beyond traditional vulnerability scanning and reporting. The team is looking for a hands-on security leader who can take a vulnerability from identification through validation, risk analysis, attack-path assessment, and remediation follow-through.

The environment is currently earlier in its vulnerability management maturity journey, so this person will have the opportunity to significantly influence how the program evolves.

What you’ll be responsible for:

• Own and mature the vulnerability management lifecycle across endpoints, servers, networks, cloud platforms, applications, containers, and other enterprise technologies
• Validate vulnerabilities and determine real-world exploitability rather than relying solely on scanner severity
• Build the “attack story” around findings by connecting vulnerabilities to threat actors, TTPs, attack paths, and business impact
• Partner with infrastructure, network, cloud, application, and technology owners to drive remediation through closure
• Improve asset visibility, scanner coverage, data quality, and vulnerability-management processes
• Help mature exposure-management capabilities, including internal/external attack surface and attack-path analysis
• Evaluate vulnerability and exposure recommendations from platforms such as Microsoft Defender and determine what is truly actionable
• Support risk-based prioritization, risk acceptance, compensating controls, and remediation decisions when vulnerabilities cannot immediately be patched
• Monitor emerging vulnerabilities, active exploitation, threat intelligence, and evolving AI-related security risks
• Provide initial incident/security-event triage and identify when activity requires deeper investigation or escalation
• Communicate vulnerability and exposure risk clearly to both technical teams and senior leadership

What we’re looking for:

• Strong background in enterprise Vulnerability Management or Exposure Management
• Experience owning vulnerabilities beyond the “scan and report” stage
• Ability to analyze exploitability, attack paths, threat activity, and business risk
• Working knowledge of Incident Response, security operations, or threat analysis
• Experience with tools such as Qualys, Tenable, Rapid7/Nexpose, Microsoft Defender Vulnerability Management, or similar platforms
• Understanding of asset-management and vulnerability-data reconciliation across enterprise environments
• Familiarity with CVSS, EPSS, CISA KEV, threat intelligence, risk acceptance, and compensating controls
• Strong communication skills and the ability to influence remediation without direct authority
• Ability to operate independently and comfortably communicate with senior leadership

This is an excellent opportunity for someone who wants to take ownership of a vulnerability program, improve its maturity, and connect vulnerability management more directly with threat intelligence, incident response, and real-world exposure.