[Remote] Vulnerability Management Manager

Note: The job is a remote job and is open to candidates in USA. Avaya is seeking a Vulnerability Management Lead to advance vulnerability management and remediation across the cloud environments supporting its applications and services. The role leads vulnerability management engineers, drives cross-functional remediation, and strengthens security, risk management, and compliance practices.

Responsibilities

• Vulnerability Management & Remediation: Lead the identification, tracking, prioritization, and remediation of infrastructure and application vulnerabilities. Maintain visibility into the vulnerability portfolio and drive findings through resolution within established remediation timelines
• Team Leadership & Workload Management: Lead and develop the vulnerability management engineering team. Establish priorities, balance workloads, coordinate assignments, and provide technical guidance to support timely and effective remediation
• Risk Management & Compliance: Drive remediation activities aligned with enterprise risk requirements, security policies, and BOD 26-04 obligations. Partner with application owners, vendor managers, and risk stakeholders to resolve vulnerabilities within required time frames
• Security Operations & Incident Response: Represent infrastructure vulnerability management during incident calls involving application vulnerabilities. Coordinate escalations, communicate remediation status, and collaborate with security teams to address emerging risks and operational concerns
• Vulnerability Intelligence & Threat Analysis: Monitor industry trends, emerging vulnerabilities, threat intelligence, and adversary techniques to assess potential organizational impact. Apply knowledge of common attack vectors, intrusion techniques, and the MITRE ATT&CK framework to support vulnerability prioritization and risk reduction
• Security Monitoring & Technical Analysis: Leverage vulnerability assessment tools, SIEM platforms, network traffic analysis, and security event correlation to investigate findings, validate remediation progress, and identify potential security gaps
• Risk Metrics & Executive Reporting: Develop, maintain, and quality-assure monthly vulnerability and risk metrics for management and executive stakeholders. Provide clear visibility into remediation progress, outstanding risks, compliance status, and opportunities for continued improvement
• Process Engineering & Continuous Improvement: Identify gaps in vulnerability management processes, compliance controls, and operational workflows. Develop and implement improvements that strengthen remediation accountability, improve efficiency, and reduce recurring security issues
• Documentation & Knowledge Management: Create and maintain team processes, procedures, operational standards, and training documentation. Ensure vulnerability management practices are consistent, repeatable, and aligned with enterprise security objectives
• Training & Team Development: Support onboarding, training, and ongoing development of vulnerability management engineers. Promote knowledge sharing, technical consistency, and effective collaboration across cybersecurity and infrastructure teams
• Cross-Functional Collaboration: Partner with application engineering, infrastructure operations, security operations, vendor management, and risk teams to resolve technical and process-related challenges and maintain accurate vulnerability records in the system of record
• Operational Excellence & Technology Evolution: Evaluate emerging security tools, assessment methodologies, and industry practices to improve vulnerability detection, remediation workflows, and overall security program effectiveness

Skills

• Demonstrated ability to lead vulnerability management engineers, coordinate remediation activities, balance team workloads, and drive accountability across technical teams
• Hands-on experience with cybersecurity tools and technologies such as Qualys, Nessus, and Symantec, including vulnerability assessment, prioritization, tracking, and remediation
• Understanding of enterprise risk management, vulnerability remediation requirements, security controls, and compliance frameworks, including BOD 26-04, NIST CSF, NIST SP 800-53, ISO 27001, and PCI DSS ASV
• Knowledge of common attack vectors, adversary tactics and techniques, threat intelligence, security hardening, and the MITRE ATT&CK framework
• Experience with Security Information and Event Management (SIEM) platforms, including Splunk, security event correlation, monitoring programs, and investigation of security-related issues
• Ability to investigate complex security, network, system, and application issues; analyze network traffic and packets; and identify practical solutions to vulnerability and remediation challenges
• Experience maintaining vulnerability records, preparing risk metrics, supporting management reporting, and communicating remediation status and exposure to technical and executive stakeholders
• Ability to identify operational gaps, develop actionable solutions, establish repeatable processes, and build roadmaps that align vulnerability management activities with broader cybersecurity operations goals
• Strong written and verbal communication skills, with the ability to coordinate across teams, manage competing priorities, communicate technical findings, and drive remediation through resolution
• A bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field, or an equivalent combination of education and relevant experience
• Ability to manage multiple priorities and deadlines, work independently and collaboratively, and participate in after-hours and weekend on-call rotations as business needs require
• 6+ years of relevant IT or cybersecurity experience
• 5+ years of security experience with hands-on exposure to cybersecurity products such as Qualys, Symantec, or Nessus
• 3+ years of experience with Security Information and Event Management (SIEM) platforms
• 3+ years of experience supporting or analyzing adversary tactics and techniques using the MITRE ATT&CK framework
• Knowledge of cybersecurity standards and frameworks, including ISO 27001, NIST CSF, NIST SP 800-53, PCI DSS ASV, and BOD 26-04
• Strong written and verbal communication, organizational, analytical, and problem-solving skills
• Ability to coordinate multiple initiatives, manage competing priorities, and drive remediation activities across cross-functional teams
• Ability to support after-hours and weekend on-call rotations as required
• Applicants must be currently authorized to work in the United States without the need for visa sponsorship now or in the future
• Experience with cloud enterprise security tools, risk assessment methodologies, security controls, and vulnerability management in SaaS or other cloud-based environments
• Experience with URL filtering, web proxy technologies, network troubleshooting, packet analysis, and network security controls
• Demonstrated experience developing management presentations, executive dashboards, and operational reporting using tools such as PowerPoint and Visio
• Familiarity with vulnerability remediation mandates, security compliance requirements, and enterprise risk reporting, particularly BOD 26-04
• A track record of improving remediation timelines, reducing outstanding vulnerabilities, strengthening compliance, and delivering measurable reductions in security risk over time
• Industry-recognized cybersecurity certification in one or more of the following: CompTIA Security+, CISSP, GIAC, or GCIH
• Experience with URL filtering, web proxy technologies, and troubleshooting
• Experience creating executive presentations, developing risk metrics, and supporting management reporting
• Demonstrated ability to improve vulnerability remediation timelines and deliver sustained, measurable reductions in organizational risk

Company Overview