Head of Vulnerability Management

The position is described below. If you want to apply, click the Apply Now button at the top or bottom of this page. After you click Apply Now and complete your application, you'll be invited to create a profile, which will let you see your application status and any communications. If you already have a profile with us, you can log in to check status. Need Help? If you have a disability and need assistance with the application, you can request a reasonable accommodation. Send an email to Accessibility (accommodation requests only; other inquiries won't receive a response).

Regular or Temporary:

Regular Language Fluency:

English (Required)

Work Shift:

1st shift (United States of America) Please review the following job description: We are seeking an IT Vulnerability Management Leader to drive the strategy, processes, tooling, and execution of a comprehensive vulnerability management program within a regulated banking environment. This role will be responsible for ensuring proactive identification, assessment, remediation, and reporting of security vulnerabilities across the bank's IT infrastructure, applications, and cloud environments. The ideal candidate will have deep expertise in vulnerability lifecycle management, risk-based prioritization, regulatory compliance (e.g., FFIEC, OCC, SOX, PCI-DSS), and automation to improve security posture while aligning with business objectives.

ESSENTIAL DUTIES AND RESPONSIBILITIES

Following is a summary of the essential functions for this job. Other duties may be performed, both major and minor, which are not mentioned below. Specific activities may change from time to time. Strategy & Governance Develop and lead the enterprise-wide vulnerability remediation team, aligning with cybersecurity, risk, and compliance frameworks. Establish policies, standards, and best practices for vulnerability identification, prioritization, and remediation. Align vulnerability management processes with FFIEC, OCC, GLBA, NIST, SOX, and PCI-DSS regulatory requirements. Collaborate with risk management, audit, and compliance teams to ensure regulatory reporting and risk mitigation strategies are met. Vulnerability Management Process Define and implement a risk-based vulnerability management lifecycle, including scanning, analysis, remediation, and validation. Develop and enforce Service Level Agreements (SLAs) for vulnerability remediation based on risk severity. Work with IT, DevOps, and engineering teams to integrate security patching and vulnerability remediation into operational workflows. Establish automated patching and compensating controls for high-risk vulnerabilities. Tooling & Automation Own the selection, implementation, and optimization of vulnerability management, and remediation tools. Leverage AI, automation, and security orchestration tools to accelerate vulnerability detection and remediation. Integrate vulnerability data with SIEM, ITSM, and risk management platforms for real-time visibility and response. Execution & Remediation Oversight Lead the end-to-end vulnerability detection, risk assessment, and remediation execution across cloud, on-premises, and third-party environments. Collaborate with IT infrastructure, application security, and DevSecOps teams to ensure timely patching, configuration hardening, and secure coding practices. Drive continuous improvement initiatives to enhance vulnerability detection, threat intelligence, and risk reduction. Risk-Based Prioritization & Reporting Develop and implement a risk-based vulnerability prioritization model using CVSS scores, threat intelligence, and business impact analysis. Establish executive-level dashboards and reporting on vulnerability trends, risk posture, and compliance adherence. Provide regular briefings to senior leadership, cybersecurity committees, and regulatory bodies. Incident Response & Crisis Management Act as a key stakeholder in security incident response, coordinating with SOC, threat intelligence, and forensics teams on vulnerability exploitation scenarios. Lead post-mortem analyses on critical vulnerabilities and breaches to strengthen future resilience. Qualifications Required Qualifications The requirements listed below are representative of the knowledge, skill and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. 1. Bachelor's degree in Computer Science, Engineering, Information Systems, or related field. 2. Minimum of 10 years of professional experience in infrastructure engineering with progressive management responsibilities. 3. Proven experience managing a large team within a technology environment. 4. Strong knowledge of enterprise infrastructure technologies including cloud, network, database, storage, platform, computing, and middleware. Preferred Qualifications 10+ years of experience in IT security, vulnerability management, or cybersecurity risk management. Strong expertise in vulnerability management tools (e.g., Tenable, Qualys, Rapid7, ServiceNow VR, Prisma Cloud, AWS Security Hub). Experience in highly regulated banking environments, ensuring compliance with

FFIEC, OCC, GLBA, SOX, PCI-DSS, NIST

800-53, and CIS benchmarks. Proven ability to develop and implement vulnerability management programs at an enterprise scale. Strong knowledge of cloud security vulnerabilities (AWS, Azure, GCP) and container security (Kubernetes, Docker). Experience working with patch management solutions, threat intelligence platforms, and security automation. Familiarity with risk-based vulnerability prioritization frameworks (e.g., EPSS, MITRE

ATT&CK, CVSS

v3+). Strong leadership and stakeholder management skills, with experience engaging CTO, CISO, CIO, and regulatory bodies. CISSP, CISM, OSCP, CRISC, or GIAC certifications. Hands-on experience integrating vulnerability data with SIEM, SOAR, and ITSM platforms. Knowledge of DevSecOps practices and secure CI/CD pipeline integration.

Compliance and Regulatory Knowledge:

In-depth understanding of compliance in regulated industries (e.g., financial services, healthcare). Experience working with audit and risk management processes.

Stakeholder Engagement & Communication:

Facilitate collaboration between application, infrastructure, and business teams to drive efficiency and innovation. Demonstrated ability to partner with line-of-business leaders, security teams, and developers to drive collaborative outcomes. Excellent communication and influence skills to balance business, technology, and compliance needs. General Description of Available Benefits for

Eligible Employees of Truist Financial Corporation:

All regular teammates (not temporary or contingent workers) working 20 hours or more per week are eligible for benefits, though eligibility for specific benefits may be determined by the division of Truist offering the position. Truist offers medical, dental, vision, life insurance, disability, accidental death and dismemberment, tax-preferred savings accounts, and a 401k plan to teammates. Teammates also receive no less than 10 days of vacation (prorated based on date of hire and by full-time or part-time status) during their first year of employment, along with 10 sick days (also prorated), and paid holidays. For more details on Truist's generous benefit plans, please visit our Benefits site. Depending on the position and division, this job may also be eligible for Truist's defined benefit pension plan, restricted stock units, and/or a deferred compensation plan. As you advance through the hiring process, you will also learn more about the specific benefits available for any non-temporary position for which you apply, based on full-time or part-time status, position, and division of work. Truist is an Equal Opportunity Employer that does not discriminate on the basis of race, gender, color, religion, citizenship or national origin, age, sexual orientation, gender identity, disability, veteran status, or other classification protected by law. Truist is a Drug Free Workplace. EEO is the Law E-Verify IER Right to Work About Truist Truist is a purpose-driven financial services company, formed by the historic merger of equals of BB&T and SunTrust. We serve clients in a number of high-growth markets in the country, offering a wide range of financial services. At Truist, our purpose is to inspire and build better lives and communities. That happens through real care to make things better. To meet client needs, to empower teammates, and to lift up communities. Learn more about Truist on truist.com.