Vulnerability Program Manager

Accountabilities:

• • Own the end-to-end vulnerability management and patching program, including asset discovery, scanning, risk-based prioritization, remediation tracking, verification, exception management, and reporting.
  • Define and document standardized service processes, including scan frequency, patching cadence, severity-based remediation targets, risk acceptance procedures, and emergency response criteria.
  • Establish clear roles and responsibilities across vulnerability analysts, security engineering, service desk teams, and client stakeholders.
  • Design ticket types, templates, workflows, and reporting processes in PSA tooling to ensure vulnerability and patching activities are consistently documented.
  • Run recurring vulnerability management reviews for assigned clients, maintain prioritized remediation backlogs, and proactively escalate stalled or aging findings.
  • Coordinate remediation across internal delivery teams and client personnel, taking change windows, maintenance periods, and operational constraints into account.
  • Manage exclusions, suppressions, and risk acceptances with appropriate documentation, ownership, rationale, and review dates.
  • Act as the escalation point for urgent vulnerability response, including zero-day vulnerabilities and actively exploited threats requiring out-of-cycle remediation.
  • Own client-facing vulnerability reporting, including recurring review materials, aging and trend analysis, and executive-level summaries.
  • Present risk, remediation progress, and program status to technical and non-technical client stakeholders while clearly communicating responsibilities, dependencies, and required actions.
  • Support audits and compliance requirements involving frameworks such as CMMC, PCI DSS, SOC 2, HIPAA, and NCUA examinations.
  • Partner with client success and account teams during onboarding, escalations, renewals, and other client engagements.
  • Maintain the operational health of vulnerability management tooling, including scanner coverage, credentialed scanning, agent deployment, and asset inventory accuracy.
  • Collaborate with security engineering to integrate scanning, ticketing, and patching platforms and reduce manual reporting effort.
  • Identify data-quality issues such as stale assets, duplicate records, and unmanaged endpoints that can affect vulnerability reporting.
  • Define and track metrics including remediation SLA attainment, vulnerability aging, patch compliance, scan coverage, and recurring findings.
  • Use program data to identify systemic issues and drive improvements to processes, tooling, automation, and service delivery.
  • Train and mentor vulnerability analysts and other delivery personnel on standardized processes and contribute to the development of vulnerability management service offerings.

  Requirements:

  • Demonstrated experience managing vulnerability management and patching programs across multiple clients or environments, preferably within an MSP or MSSP.
  • Hands-on experience with vulnerability management and patching platforms such as InsightVM, ConnectSecure, NinjaOne, Datto RMM, or equivalent technologies.
  • Working knowledge of PSA and workflow platforms, with HaloPSA experience preferred, including ticket configuration and reporting.
  • Practical understanding of risk-based vulnerability prioritization using CVSS, exploit intelligence, asset criticality, and business context rather than relying solely on severity scores.
  • Familiarity with cybersecurity and compliance requirements associated with CMMC, PCI DSS, SOC 2, HIPAA, and NCUA examinations.
  • Strong written and verbal communication skills, including experience leading client meetings and translating technical findings for non-technical audiences.
  • Ability to coordinate and influence work across multiple teams without direct reporting authority.
  • Strong organizational, analytical, and problem-solving skills, with the ability to manage competing priorities and maintain consistent follow-through.
  • Relevant certifications such as Security+, GIAC, CISSP, or vendor-specific credentials are preferred but not required.
  • Comfortable working directly in security tooling and taking a hands-on approach rather than managing program activities solely from a strategic or administrative level.

  Benefits:

  • Salary: $75,000–$100,000 annually.
  • Full-time, exempt position.
  • Standard business hours with flexibility around month-end close.
  • Innovative cybersecurity and IT solutions supporting financial and regulated industries.
  • Opportunities for professional growth and hands-on exposure to enterprise-level security operations and program execution.
  • Collaborative, people-focused environment that values learning, structure, and shared success.
  • Occasional travel opportunities for client engagement, team integration, and offsite activities.