Vulnerability Management Manager

Considine Search; New York (NY); On-site; USD 200,000 - 215,000; Full time

Job summary

Considine Search is seeking a Vulnerability Management Manager for our New York team. You will lead enterprise vulnerability management, oversee identification, assessment, prioritization, and remediation across endpoints, servers, and cloud, and drive program strategy in alignment with risk tolerance and regulatory obligations.

You will collaborate with security and IT teams, design remediation schedules, track SLAs, and report on trends and KPIs to executives.

Qualifications

• Bachelor's degree in IT, CS, or related field or equivalent experience.
• 3–5 years in vulnerability or patch management in medium to large enterprises.
• Familiarity with CVSS/EPSS, and risk-based decision making.
• Experience with security frameworks such as NIST CSF or ISO 27001.
• Strong communication and cross-functional collaboration skills.
• Ability to obtain/maintain a secret clearance; U.S. citizenship required.

Responsibilities

• Lead assessment, prioritization, and remediation tracking across endpoints, servers, and cloud environments.
• Evaluate vulnerability criticality using risk-based frameworks and threat intel.
• Design and maintain remediation schedules and maintenance windows.
• Ensure timely patching and track deployment status with SLAs.
• Correlate scan findings with patch status to identify gaps and report trends.
• Lead emergency patching for actively exploited vulnerabilities.

Skills

Vuln mgmt

Patch mgmt

Risk assessment

Communication

Security frameworks

Certifications

Education

Bachelor's degree or equivalent experience

Tools

Tenable

Qualys

Rapid7

WSUS

SCCM

Intune

Job description

New York, NY

Summary

The Vulnerability Management Manager, working closely with the information security team, leads the enterprise vulnerability management program, overseeing the continuous identification, assessment, prioritization, and remediation of vulnerabilities across operating systems, applications, and infrastructure components. This role designs and governs program strategy, collaborates cross-functionally with security and operations teams, and ensures remediation efforts align with Firm’s risk tolerance, regulatory obligations, and industry best practices.

Responsibilities

• Lead the assessment, prioritization, and remediation tracking of vulnerabilities across enterprise endpoints, servers, and cloud environments, collaborating with information security, and IT teams to align remediation activities with identified threats.
• Evaluate vulnerability criticality using risk-based frameworks (CVSS, EPSS, CISA KEV) in conjunction with threat intelligence and business context to drive informed remediation decisions
• Design and maintain vulnerability remediation and patching schedules, phased rollout plans, and maintenance windows that minimize business impact while satisfying security and compliance requirements
• Ensure timely patching of enterprise desktops, servers, and applications by coordinating with product owners and patch management teams, tracking deployment status, enforcing remediation SLAs, and ensuring exceptions are documented and risk-accepted through a formal process
• Correlate vulnerability scan findings with patch deployment status to identify coverage gaps, report on compliance rates, and elevate systemic gaps or high-risk exceptions to the information security team
• Lead emergency and out-of-band patching efforts for actively exploited or critical vulnerabilities, coordinating rapid deployment with minimal business disruption
• Perform advanced troubleshooting for complex or high-risk vulnerabilities, working with system administrators, application owners, and engineering teams on remediation or compensating controls
• Enforce patch compliance standards, ensuring patching activities align with organizational policy and frameworks such as NIST and CIS Controls
• Document vulnerability management procedures, baselines, exception handling, and reporting methods to support audits and continuous improvement
• Develop and deliver reporting on vulnerability trends, program KPIs, and risk exposure for both technical teams and executive leadership

Requirements

• Bachelor’s degree in IT, Computer Science, or a related field, or equivalent relevant experience
• 3–5 years of experience in vulnerability management, patch management, or related infrastructure security roles in medium to large enterprises
• Strong understanding of vulnerability and patch management principles and experience with tools such as Tenable, Qualys, or Rapid7, and familiarity with endpoint patch management platforms including WSUS, SCCM, and Intune
• Proven problem solving, analytical, communication, and interpersonal skills with the ability to manage multiple priorities effectively
• Experience with assessments, audits, and implementing automated vulnerability management solutions, including SLA tracking and compliance reporting
• Familiarity with security and compliance frameworks such as NIST CSF or ISO 27001
• Ability to obtain and maintain a Secret clearance; U.S. citizenship required
• Relevant certifications such as CISSP, CISM, CISA, or similar security certifications are a plus

Compensation

$200,000.00-$215,000.00, plus bonus

Salary

$200,000.00-$215,000.00, plus bonus

Date Active: 8/6/2026

Exempt/Not Exempt: Exempt