Senior Cybersecurity Risk & Vulnerability Management Advisor

Vanguard; United States; Hybrid; USD 120,000 - 170,000; Full time

Benefits offered by this job

Hybrid work model

Professional development

Job summary

Vanguard is seeking an experienced security leader to drive vulnerability risk management across its technology environments. The role partners with Global Technology Operations to translate technical risk into actionable business decisions and to guide remediation with senior stakeholders.

You will oversee risk dashboards, coordinate cross-functional remediation, and help set security requirements for cloud and on-prem resources. Strong communication and governance experience are essential.

Qualifications

• Eight+ years in IT security or related fields.
• Undergraduate degree or equivalent training and experience.
• Ability to translate technical findings into business risk narratives.
• Excellent written and verbal communication with leadership.

Responsibilities

• Leads vulnerability risk management and remediation oversight; analyzes data and drives remediation.
• Communicates vulnerability posture, trends, and exposures to senior leadership.
• Acts as technical risk liaison between GTO and security stakeholders to enable outcomes.
• Translates findings into actionable business-risk information for technology teams.
• Drives cross-functional remediation initiatives across multiple teams.
• Partners with infrastructure and security teams to identify gaps and security practices.
• Develops security assessment plans and identifies corrective measures.
• Works with IT subdivisions and vendors to assess security risks and impacts.
• Evaluates security requirements for data systems and networks; coordinates initiatives.
• Facilitates escalation of vulnerabilities nearing deadlines and manages vendor relations.
• Maintains knowledge of emerging practices and leads Security Champion community.
• Participates in special projects and other duties.

Skills

Security governance

Risk communication

Stakeholder management

Threat analysis

Cloud infrastructure

Incident response

Education

Bachelor's degree

Tools

Archer

Wiz

Qualys

Tableau

Microsoft 365

Job description

Core Responsibilities:

• Leads vulnerability risk management and remediation oversight across technology environments. Analyzes infrastructure vulnerability data to validate risk, applicability, ownership, remediation status, and reporting accuracy; identifies themes and actionable insights; and performs targeted outreach to drive resolution.
• Develops and communicates vulnerability posture, trends, remediation deadlines, and material exposures to senior leadership. Monitors security dashboards and risk metrics, investigates reporting discrepancies, and improves reporting accuracy.
• Serves as the technical risk liaison between GTO (Global Technology Operations) and security stakeholders, helping infrastructure operations teams navigate the security organization, clarify security dependencies, remove roadblocks, and enable strategic outcomes.
• Translates technical findings into actionable business-risk information and advises technology teams on security requirements, risk-treatment decisions, and enterprise security initiatives.
• Drives cross-functional remediation initiatives and coordinates resolution of high-risk security findings across GTO, Enterprise Security, infrastructure, application, engineering, technology owners, and supporting teams.
• Partners with infrastructure, networking, platform, and other technology teams to perform root-cause analysis of vulnerabilities, identify security control or process gaps, and recommend security practices that help prevent, detect, and remediate future issues.
• Develops and leads security assessment plans to evaluate the adequacy of information security controls. Identifies vulnerabilities, integration requirements and implications, emerging security needs, and appropriate corrective measures.
• Works with IT subdivisions, third-party partners, and business units to assess and communicate security risks and the operational impacts of technology implementations.
• Evaluates security requirements for data systems, networks, and websites; identifies enterprise technical security solutions; and coordinates adoption of security initiatives and solutions.
• Facilitates escalation and resolution of vulnerabilities approaching remediation deadlines or requiring additional management attention and manages vendor relationships.
• Maintains knowledge of emerging security practices, standards, policies, and industry trends and leads engagement and enablement of the Security Champion community.
• Participates in special projects and performs other duties as assigned.

Qualifications:

• Minimum eight years of related work experience. Experience in IT security or application development preferred.
• Undergraduate degree in a related field or equivalent combination of training and experience.
• Demonstrated experience interfacing with, presenting to, and reporting to senior-level leadership, with the ability to translate complex technical and security information into clear, actionable business-risk narratives.
• Strong written and verbal communication skills, executive presence, and the ability to communicate effectively with technical and non-technical stakeholders.
• Strong technical acumen and understanding of infrastructure and cloud operations, with the ability to effectively partner with infrastructure and other technical teams.
• Knowledge of cybersecurity frameworks and security best practices, particularly NIST, with the ability to identify control and process gaps and recommend corrective actions.

Preferred Experience & Skills:

• Previous experience as a Business Information Security Officer (BISO), IT Risk Manager, IT Controls Manager, or in a similar technical security governance and reporting role.
• Experience supporting technology or infrastructure organizations in a security, risk, controls, or governance capacity.
• Familiarity with cloud computing concepts and ITIL.
• Familiarity with security and risk platforms such as Archer, Wiz, and Qualys.
• Experience utilizing reporting and productivity tools such as Tableau and Microsoft 365. Tableau experience is preferred but not required.
• Security certification such as ISC2 CISSP, GIAC Security Essentials Certification (GSEC), GIAC Penetration Tester Certification (GPEN), GIAC Web App Pen Tester (GWPN), or Certified Ethical Hacker (CEH) preferred.
• Strong relationship-management, persuasion, and influencing capabilities across security and technology stakeholders.

Special Factors

Sponsorship
Vanguard is not offering visa sponsorship for this position.

About Vanguard

At Vanguard, we don't just have a mission—we're on a mission.

To work for the long-term financial wellbeing of our clients. To lead through product and services that transform our clients' lives. To learn and develop our skills as individuals and as a team. From Malvern to Melbourne, our mission drives us forward and inspires us to be our best.

How We Work

Vanguard has implemented a hybrid working model for the majority of our crew members, designed to capture the benefits of enhanced flexibility while enabling in-person learning, collaboration, and connection. We believe our mission-driven and highly collaborative culture is a critical enabler to support long-term client outcomes and enrich the employee experience.