Senior Security Manager - Vulnerability Management

Alter Domus; New York (NY); On-site; USD 180,000 - 240,000; Full time

Benefits offered by this job

Professional accreditations support

Flexible work arrangements

Generous holidays

Mentoring and career development

Employee Assistance Program

Employee Share Plan

Job summary

Alter Domus is seeking a Senior Security Manager, Vulnerability Management to own and mature the enterprise VM program. You will lead strategy, tooling and governance, drive remediation across on-prem, cloud, and hybrid environments, and manage a small team reporting to the CISO.

You will work with Infrastructure, App, and DevOps teams to reduce risk, leverage AI-driven risk scoring, and ensure audit readiness for SOC 2/ISO 27001. This role is based in New York/Chicago/Salt Lake City.

Qualifications

• 10+ years of information security experience, with 5+ years in vulnerability/attack-surface management.
• Experience in regulated financial services environments is preferred.
• Proven ability to translate risk into business narrative and reports.

Responsibilities

• Lead enterprise Vulnerability Management program end-to-end across on-prem, cloud, and hybrid environments.
• Build and mentor a small VM/ASM team; drive KPIs and remediation SLAs.
• Collaborate with IT, DevOps, and security teams to reduce the attack surface.

Skills

Vulnerability management

Leadership

Stakeholder communication

Cloud security

Threat intelligence

AI/ML risk scoring

Security governance

Education

Bachelor's degree in Information Security or related field

Tools

VM platform

CIS Benchmarks

SOC 2 / ISO 27001

Job description

Senior Security Manager - Vulnerability Management

Location:
New York, US Chicago, US Salt Lake City, US

ABOUT US:

As a world leading provider of integrated solutions for the alternative investment industry, Alter Domus (meaning “The Other House” in Latin) is proud to be home to 90% of the top 30 asset managers in the private markets, and more than 6,000 professionals across 24 jurisdictions.

With a deep understanding of what it takes to succeed in alternatives, we believe in being different in what we do, how we work, and most importantly in how we enable and develop our people. Invest yourself in the alternative, and join an organization where you progress on merit, where you can speak openly with whoever you are speaking to, and where you will be supported along whichever path you choose to take.

Find out more about life at Alter Domus at careers.alterdomus.com

We are seeking a Senior Security Manager, Vulnerability Management to own and mature AlterDomus’s enterprise vulnerability management program and drive continuous reduction of our attack surface. Reporting to the CISO, you will lead the strategy, tooling, and operating cadence for identifying, prioritizing, and remediating vulnerabilities across infrastructure, cloud, and business applications — while leading a small team and representing the program in governance, audit, and executive reporting forums.

KEY RESPONSIBILITIES

Vulnerability Management Program Leadership

Own and continuously mature the end-to-end enterprise Vulnerability Management (VM) program — policy, scanning cadence, risk-based prioritization, and remediation SLAs — across on-premises, cloud, and hybrid environments.

Build, lead, and develop a small team of vulnerability management analysts/engineers, setting priorities and managing delivery against program KPIs.

Partner with Infrastructure, Application, and DevOps teams to drive timely remediation of critical and high-risk findings; manage formal risk-acceptance and exception processes for items that cannot be remediated on schedule.

Identify and reduce the organization’s attack surface, including unmanaged assets, shadow IT, and internet-facing exposures, in partnership with IT and Network teams.

Vulnerability Management Platform Deployment & Operations

Own the deployment, configuration, and ongoing administration of the enterprise vulnerability management (VM) scanning and detection–response platform across the enterprise estate.

Drive scanner/agent coverage expansion, asset discovery accuracy, and integration of the VM platform with ITSM/ticketing and CMDB tools.

Continuously tune scan policies, authentication, and reporting configurations to improve detection accuracy and reduce false positives.

Evaluate and recommend enhancements to the VM tooling stack as the threat landscape and business needs evolve.

AI-Augmented Vulnerability Management

Leverage AI/ML-driven risk scoring and predictive exploitability signals (beyond static CVSS) to sharpen remediation prioritization and focus analyst effort on the highest-impact exposures.

Evaluate and adopt AI-assisted capabilities within the VM platform — automated finding triage, deduplication, and correlation with threat intelligence — to increase remediation velocity and reduce manual analyst workload.

Extend vulnerability and attack surface management practices to AI/ML assets in use across the business — models, training data pipelines, and AI-enabled applications — identifying and remediating AI-specific exposures.

Partner with Security Governance on emerging AI risk frameworks (e.g., NIST AI RMF, OWASP Top 10 for LLM Applications) where they intersect with vulnerability and configuration management practices.

Governance, Metrics & Reporting

Design and maintain executive and operational reporting (KPIs/KRIs, remediation SLA performance, risk trends) for the CISO, technology leadership, and risk committees.

Own and keep current the vulnerability management policies, standards, and procedures in line with the evolving threat landscape and regulatory expectations.

Present program status, risk posture, and remediation progress at security governance forums and, as needed, executive-level updates.

Audit & Compliance

Serve as the primary control owner for vulnerability and configuration management controls during SOC 2 (Type I/II) and related audits (e.g., ISO 27001, client due-diligence reviews).

Manage evidence collection, auditor engagement, and remediation tracking for audit findings tied to vulnerability, patch, and configuration management.

Support broader information security governance activities, including risk assessments and control testing, as needed.

PREFERRED EXPERIENCE & QUALIFICATIONS

The ideal candidate will bring deep, hands-on expertise in vulnerability and attack surface management, with demonstrated leadership in regulated financial services environments. Preferred experience includes:

Leadership & General

10 + years of information security experience, including 5 + years leading or managing a vulnerability management or attack surface management function — ideally within financial services or another regulated industry.

Proven track record of representing risk and program status to senior stakeholders, translating technical findings into clear business narrative.

Proven people-management experience, with a track record of building, coaching, and developing a small security team.

Technical Skills

Hands-on experience deploying, administering, and optimizing an enterprise vulnerability management (VM) platform at scale.

Working knowledge of CIS Benchmarks, CVE/CVSS scoring, and secure configuration and hardening practices across Windows, Linux, cloud (AWS/Azure), and network infrastructure.

Experience leading or coordinating vulnerability assessments and penetration testing of business applications, and turning findings into actionable remediation plans.

Direct experience as a control owner supporting SOC 2 (Type I/II) or comparable compliance audits (e.g., ISO 27001, NIST CSF).

Strong written and verbal communication skills, with the ability to present risk and program metrics to both technical and executive/non-technical audiences.

AI & Automation

Familiarity with AI/ML-driven vulnerability prioritization and risk-scoring capabilities (e.g., predictive exploitability, threat-intel correlation) available in modern VM platforms.

Familiarity with using or evaluating AI-powered automation for vulnerability triage, deduplication, or remediation-guidance generation.

Working knowledge of AI/LLM-specific risk considerations (e.g., OWASP Top 10 for LLM Applications, model and data-pipeline exposures) as they relate to attack surface and vulnerability management.

Practical use of generative AI tools to accelerate reporting, documentation, or remediation playbooks is a plus.

Certifications (Preferred)

CISSP, CISM, GCVA, GPEN, or equivalent. AI/ML security credential (e.g., GIAC AI SecurityAutomation Engineer – GASAE) a plus.

WHAT WE OFFER

We are committed to supporting your development, advancing your career, and providing benefits that matter to you.

Our industry-leading Alter Domus Academy offers six learning zones for every stage of your career, with resources tailored to your ambitions and resources from LinkedIn Learning.

Our global benefits also include:

• Support for professional accreditations
• Flexible arrangements, generous holidays, plus an additional day off for your birthday!
• Continuous mentoring along your career progression
• Active sports, events and social committees across our offices
• 24/7 support available from our Employee Assistance Program
• The opportunity to invest in our growth and success through our Employee Share Plan

Alter Domus is an Equal Opportunity Employer: Equity Statement All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability, or protected veteran status.