WTW
Description WTW is seeking a Senior Director of Exposure & Vulnerability Management to lead WTW's vulnerability management security program. Reporting to the Global Head of Attack Surface Management, this leader owns the strategy, execution and evolution of enterprise exposure management capabilities spanning vulnerability operations, exposure validation, aligning with secure development (SAST/SCA/DAST) and risk intelligence, with a relentless focus on prioritization, business impact, mitigation strategies and measurable risk reduction. The role partners closely with Corporate & Business Technology, Cloud Operations, Product, Platform Engineering, Risk Management, Privacy & Compliance, Managed Service Providers and Internal Audit stakeholders to ensure security findings are translated into actionable insight, aligned remediation priorities and demonstrably improved security outcomes across the enterprise. As a senior member of the Attack Surface Management leadership team, the Senior Director also acts as a strategic deputy to the Global Head, contributing to program direction, investment decisions, steering committee deliverables, and executive-level reporting. The Role As WTW continues to scale its digital platforms, client services and cloud estate, managing cyber risk requires more than identifying vulnerabilities. It requires understanding exposure, exploitability, reachability and business impact across infrastructure, cloud, identity, applications and the software supply chain. The Exposure & Vulnerability Management function is accountable for transforming how security risk is identified, contextualized, validated and addressed across the enterprise. This includes shifting to a unified, continuous exposure management model that is aligned to Continuous Threat Exposure Management (CTEM) principles and built on an accurate, authoritative view of WTW's assets. The Senior Director will lead multi-disciplinary global teams while driving modernization across data, tooling, metrics, governance and engagement models. The Responsibilities Exposure Management Strategy & Program Leadership Define and own WTW's enterprise exposure & vulnerability management strategy and a multi-year roadmap that aligns infrastructure, cloud, application, identity and software supply chain risk into a unified risk view. Operationalize a continuous exposure & vulnerability management lifecycle (scoping, discovery, prioritization, validation and mobilization) aligned to CTEM principles. Track vulnerabilities via risk-based prioritization grounded in exploitability, threat intelligence, asset criticality, exposure and business impact. Establish clear ownership models, accountability and engagement patterns with technology and engineering teams to drive timely and effective remediation. Own the annual operating plan and budget for exposure & vulnerability management, building business cases for investment and demonstrating return in terms of risk reduction. Discovery, Scoping & Asset Context Ensure continuous, comprehensive discovery of exposures across on-premises, cloud technologies, endpoints, IoT, SaaS and internet-facing attack surfaces. Partner with the Asset Management team to ensure exposure data is anchored to an accurate, authoritative asset inventory (CMDB), including ownership, business service mapping and criticality tiering. Ensure exposure coverage includes misconfigurations, cloud posture, identity and access weaknesses, external attack surface and unmanaged or shadow assets. Risk-Based Prioritization & Exposure Validation Own and continuously refine WTW's risk-based vulnerability scoring and prioritization model, incorporating exploit prediction (e.g. EPSS), known-exploited intelligence (e.g. CISA KEV), threat intelligence, compensating controls and business context. Establish exposure validation capabilities, including attack path analysis, breach and attack simulation, and coordination with penetration testing and red team functions, to confirm real-world exploitability. Define and maintain risk-tiered remediation SLAs that differentiate by exposure, asset type and business criticality. Vulnerability Operations & Remediation Mobilization Lead global teams responsible for vulnerability operations, ensuring consistent, scalable execution of discovery, validation, prioritization, tracking and closure across technology domains. Drive remediation mobilization through integrated workflows, clear hand-offs to owning teams and escalation paths for overdue or high-risk exposures. Lead WTW's response to critical and emerging vulnerabilities (e.g. zero-days and widely exploited flaws), coordinating rapid impact assessment, executive communication and accelerated remediation with Security Operations, Incident Response and Technology. Maintain availability for critical and emerging vulnerability events (e.g. zero-days), including participation in an on-call rotation or escalation structure to ensure rapid impact assessment and response outside of standard business hours. Own the vulnerability risk exception and acceptance process, ensuring exceptions are risk-assessed, time-bound, approved at the appropriate level and tracked to resolution. Secure Development & Software Supply Chain (Partner to Application Security) Partner with Application Security and Business Technology leadership to embed SAST, DAST and SCA coverage and the broader application security toolchain (e.g., secrets detection, container and infrastructure-as-code scanning) - contributing risk-based prioritization methodology and ensuring application findings feed into the same risk-ranked queue as infrastructure and cloud exposures, rather than owning the toolchain itself. Support Application Security's efforts to embed security earlier in the SDLC by aligning exposure & vulnerability management's remediation workflow, SLAs, and reporting with their developer-friendly tooling and pipeline guardrails - extending consistent tracking and accountability to application-layer findings without taking on pipeline ownership. Collaborate with Application Security, Business Technology, and GRC to strengthen software supply chain risk management - including open-source governance and SBOM practices - providing exposure-management visibility, prioritization, and reporting rather than owning the program. Governance, Regulatory & Risk Alignment Own the policies, standards and procedures governing vulnerability and exposure management, ensuring they are current, enforceable and consistently applied. Ensure the program meets regulatory and contractual obligations across WTW's operating jurisdictions, including DORA, NYDFS Part 500, GDPR and relevant client and industry requirements. Serve as the accountable lead for exposure & vulnerability management in engagements with regulators, Internal Audit, external auditors and client security assessments, and own remediation of related findings. Partner with Enterprise Risk and the second line to align exposure metrics with WTW's cyber risk appetite, key risk indicators and risk register. Assess and govern exposure risk introduced through acquisitions, divestitures and third-party or managed service providers. Data, Metrics & Risk Intelligence Build and mature exposure-focused metrics and KRIs that enable leadership to understand risk posture, trends, remediation effectiveness and SLA performance. Partner with data and analytics teams to leverage security telemetry, automation and correlation across multiple data sources. Translate technical findings into clear, decision-ready insight for the CISO, executive leadership, risk committees and, where required, the Board. Technology, Automation & Vendor Management Drive modernization of exposure & vulnerability management tooling, workflows and integrations, including consolidation and rationalization of overlapping tools. Identify and deliver opportunities for automation, orchestration and responsible use of AI to scale prioritization, triage and remediation. Partner with Product, Business Technology, Engineering, Cloud Operations, and Architecture teams to influence platform capabilities and security-by-design practices. Own vendor and managed service relationships for exposure & vulnerability management, including selection, contract governance and performance management. Leadership, Talent & Stakeholder Engagement Lead, coach and develop high-performing teams across multiple disciplines and geographies, including managers of managers. Design the organization, roles and career paths for the function; build succession and a strong bench of future leaders. Foster a culture of collaboration, accountability and continuous improvement, breaking down silos between vulnerability, asset and application security teams. Serve as a trusted advisor to Technology, Security and Risk leadership on exposure trends and remediation priorities. Influence cross-functional stakeholders without direct authority in a complex, matrixed, global environment. Qualifications . click apply for full job details
Description WTW is seeking a Senior Director of Exposure & Vulnerability Management to lead WTW's vulnerability management security program. Reporting to the Global Head of Attack Surface Management, this leader owns the strategy, execution and evolution of enterprise exposure management capabilities spanning vulnerability operations, exposure validation, aligning with secure development (SAST/SCA/DAST) and risk intelligence, with a relentless focus on prioritization, business impact, mitigation strategies and measurable risk reduction. The role partners closely with Corporate & Business Technology, Cloud Operations, Product, Platform Engineering, Risk Management, Privacy & Compliance, Managed Service Providers and Internal Audit stakeholders to ensure security findings are translated into actionable insight, aligned remediation priorities and demonstrably improved security outcomes across the enterprise. As a senior member of the Attack Surface Management leadership team, the Senior Director also acts as a strategic deputy to the Global Head, contributing to program direction, investment decisions, steering committee deliverables, and executive-level reporting. The Role As WTW continues to scale its digital platforms, client services and cloud estate, managing cyber risk requires more than identifying vulnerabilities. It requires understanding exposure, exploitability, reachability and business impact across infrastructure, cloud, identity, applications and the software supply chain. The Exposure & Vulnerability Management function is accountable for transforming how security risk is identified, contextualized, validated and addressed across the enterprise. This includes shifting to a unified, continuous exposure management model that is aligned to Continuous Threat Exposure Management (CTEM) principles and built on an accurate, authoritative view of WTW's assets. The Senior Director will lead multi-disciplinary global teams while driving modernization across data, tooling, metrics, governance and engagement models. The Responsibilities Exposure Management Strategy & Program Leadership Define and own WTW's enterprise exposure & vulnerability management strategy and a multi-year roadmap that aligns infrastructure, cloud, application, identity and software supply chain risk into a unified risk view. Operationalize a continuous exposure & vulnerability management lifecycle (scoping, discovery, prioritization, validation and mobilization) aligned to CTEM principles. Track vulnerabilities via risk-based prioritization grounded in exploitability, threat intelligence, asset criticality, exposure and business impact. Establish clear ownership models, accountability and engagement patterns with technology and engineering teams to drive timely and effective remediation. Own the annual operating plan and budget for exposure & vulnerability management, building business cases for investment and demonstrating return in terms of risk reduction. Discovery, Scoping & Asset Context Ensure continuous, comprehensive discovery of exposures across on-premises, cloud technologies, endpoints, IoT, SaaS and internet-facing attack surfaces. Partner with the Asset Management team to ensure exposure data is anchored to an accurate, authoritative asset inventory (CMDB), including ownership, business service mapping and criticality tiering. Ensure exposure coverage includes misconfigurations, cloud posture, identity and access weaknesses, external attack surface and unmanaged or shadow assets. Risk-Based Prioritization & Exposure Validation Own and continuously refine WTW's risk-based vulnerability scoring and prioritization model, incorporating exploit prediction (e.g. EPSS), known-exploited intelligence (e.g. CISA KEV), threat intelligence, compensating controls and business context. Establish exposure validation capabilities, including attack path analysis, breach and attack simulation, and coordination with penetration testing and red team functions, to confirm real-world exploitability. Define and maintain risk-tiered remediation SLAs that differentiate by exposure, asset type and business criticality. Vulnerability Operations & Remediation Mobilization Lead global teams responsible for vulnerability operations, ensuring consistent, scalable execution of discovery, validation, prioritization, tracking and closure across technology domains. Drive remediation mobilization through integrated workflows, clear hand-offs to owning teams and escalation paths for overdue or high-risk exposures. Lead WTW's response to critical and emerging vulnerabilities (e.g. zero-days and widely exploited flaws), coordinating rapid impact assessment, executive communication and accelerated remediation with Security Operations, Incident Response and Technology. Maintain availability for critical and emerging vulnerability events (e.g. zero-days), including participation in an on-call rotation or escalation structure to ensure rapid impact assessment and response outside of standard business hours. Own the vulnerability risk exception and acceptance process, ensuring exceptions are risk-assessed, time-bound, approved at the appropriate level and tracked to resolution. Secure Development & Software Supply Chain (Partner to Application Security) Partner with Application Security and Business Technology leadership to embed SAST, DAST and SCA coverage and the broader application security toolchain (e.g., secrets detection, container and infrastructure-as-code scanning) - contributing risk-based prioritization methodology and ensuring application findings feed into the same risk-ranked queue as infrastructure and cloud exposures, rather than owning the toolchain itself. Support Application Security's efforts to embed security earlier in the SDLC by aligning exposure & vulnerability management's remediation workflow, SLAs, and reporting with their developer-friendly tooling and pipeline guardrails - extending consistent tracking and accountability to application-layer findings without taking on pipeline ownership. Collaborate with Application Security, Business Technology, and GRC to strengthen software supply chain risk management - including open-source governance and SBOM practices - providing exposure-management visibility, prioritization, and reporting rather than owning the program. Governance, Regulatory & Risk Alignment Own the policies, standards and procedures governing vulnerability and exposure management, ensuring they are current, enforceable and consistently applied. Ensure the program meets regulatory and contractual obligations across WTW's operating jurisdictions, including DORA, NYDFS Part 500, GDPR and relevant client and industry requirements. Serve as the accountable lead for exposure & vulnerability management in engagements with regulators, Internal Audit, external auditors and client security assessments, and own remediation of related findings. Partner with Enterprise Risk and the second line to align exposure metrics with WTW's cyber risk appetite, key risk indicators and risk register. Assess and govern exposure risk introduced through acquisitions, divestitures and third-party or managed service providers. Data, Metrics & Risk Intelligence Build and mature exposure-focused metrics and KRIs that enable leadership to understand risk posture, trends, remediation effectiveness and SLA performance. Partner with data and analytics teams to leverage security telemetry, automation and correlation across multiple data sources. Translate technical findings into clear, decision-ready insight for the CISO, executive leadership, risk committees and, where required, the Board. Technology, Automation & Vendor Management Drive modernization of exposure & vulnerability management tooling, workflows and integrations, including consolidation and rationalization of overlapping tools. Identify and deliver opportunities for automation, orchestration and responsible use of AI to scale prioritization, triage and remediation. Partner with Product, Business Technology, Engineering, Cloud Operations, and Architecture teams to influence platform capabilities and security-by-design practices. Own vendor and managed service relationships for exposure & vulnerability management, including selection, contract governance and performance management. Leadership, Talent & Stakeholder Engagement Lead, coach and develop high-performing teams across multiple disciplines and geographies, including managers of managers. Design the organization, roles and career paths for the function; build succession and a strong bench of future leaders. Foster a culture of collaboration, accountability and continuous improvement, breaking down silos between vulnerability, asset and application security teams. Serve as a trusted advisor to Technology, Security and Risk leadership on exposure trends and remediation priorities. Influence cross-functional stakeholders without direct authority in a complex, matrixed, global environment. Qualifications . click apply for full job details
Comtecs Ltd
IT Cyber Security Specialist / Cyber Security Engineer - CISSP, CEH, CCNA Security, Incident Response, Threat Monitoring, Vulnerability Management, Security Architecture, Azure, Windows Server Infrastructure. Permanent. London Hybrid. c.£90k - £100k + Bons +Benefits Global Law Firm seeks an experienced IT Cyber Security Specialist to join its Infrastructure Engineering team, supporting and continually improving cybersecurity across a global IT environment. Reporting to the Infrastructure Engineering Manager, you'll take ownership of cybersecurity controls and security architecture while working closely with Infrastructure Operations and other technology teams to identify vulnerabilities, respond to incidents and strengthen the firm's overall security posture. This is a hands-on technical role covering Cyber Security Engineering, Incident Response, Threat Monitoring, Vulnerability Management and Security Architecture (Infrastructure focussed) using tools such as MS Defender and MS Sentinel. You'll work across a complex infrastructure environment, identifying and mitigating security risks, supporting major cyber incidents and contributing to strategic security and infrastructure projects. You'll also help develop security awareness, business continuity capabilities and ongoing improvements to the firm's security controls. Key Responsibilities: Continuously review and improve the firm's cybersecurity posture from an infrastructure perspective and external security rating. Identify, assess and remediate vulnerabilities across hardware, software and infrastructure (Windows Server and Azure Cloud). Monitor emerging threats and lead or support Incident Response investigations and mitigation. Evaluate, test and recommend security enhancements, controls and threat prevention technologies. Identify security risks and exposures and develop measures to prevent future incidents. Lead CE+ accreditation and support security, risk and data protection requirements from a technical (Not GRC) perspective. Participate in and lead infrastructure lifecycle, security and technology projects. Provide 3rd Line / Major Incident support as a cybersecurity subject matter expert. Work with third-party suppliers and advise internal technical teams on security measures to resolve security and infrastructure issues. We're looking for experienced Cyber Security engineer with strong technical infrastructure knowledge and proven experience across incident response, threat monitoring and vulnerability management. You will possess: Extensive experience in a similar role blending Cyber Security with core Wintel Infrastructure and Azure cloud engineering. Strong knowledge of modern security architecture, threat prevention techniques and incident response. Strong Windows Server 2016/2019/2022 knowledge including Active Directory, DNS, DHCP, Intune, Group Policy, PKI, Entra and Azure SSO. Demonstrable experience across Cyber Security, Incident Response, Threat Monitoring and Vulnerability Management using tools such as MS Sentinel, MS Defender etc for threat hunting, vulnerability monitoring and security posture improvement. CISSP, CEH, CCNA Security, SC-100, SC200 or equivalent security certification. Experience designing, integrating and managing complex infrastructure and cloud solutions from a cyber security standpoint and advising technical infrastructure teams on security focussed designs and operations Strong communication skills with the ability to explain complex security issues to technical and non-technical audiences. Experience working with third-party providers across on-premise and cloud services. Strong planning skills and knowledge of ITIL processes and best practice. This is an excellent opportunity to join a highly regarded global organisation where you'll play a key role in strengthening cybersecurity across a complex international IT environment, combining hands-on security engineering, incident response and strategic infrastructure projects.
IT Cyber Security Specialist / Cyber Security Engineer - CISSP, CEH, CCNA Security, Incident Response, Threat Monitoring, Vulnerability Management, Security Architecture, Azure, Windows Server Infrastructure. Permanent. London Hybrid. c.£90k - £100k + Bons +Benefits Global Law Firm seeks an experienced IT Cyber Security Specialist to join its Infrastructure Engineering team, supporting and continually improving cybersecurity across a global IT environment. Reporting to the Infrastructure Engineering Manager, you'll take ownership of cybersecurity controls and security architecture while working closely with Infrastructure Operations and other technology teams to identify vulnerabilities, respond to incidents and strengthen the firm's overall security posture. This is a hands-on technical role covering Cyber Security Engineering, Incident Response, Threat Monitoring, Vulnerability Management and Security Architecture (Infrastructure focussed) using tools such as MS Defender and MS Sentinel. You'll work across a complex infrastructure environment, identifying and mitigating security risks, supporting major cyber incidents and contributing to strategic security and infrastructure projects. You'll also help develop security awareness, business continuity capabilities and ongoing improvements to the firm's security controls. Key Responsibilities: Continuously review and improve the firm's cybersecurity posture from an infrastructure perspective and external security rating. Identify, assess and remediate vulnerabilities across hardware, software and infrastructure (Windows Server and Azure Cloud). Monitor emerging threats and lead or support Incident Response investigations and mitigation. Evaluate, test and recommend security enhancements, controls and threat prevention technologies. Identify security risks and exposures and develop measures to prevent future incidents. Lead CE+ accreditation and support security, risk and data protection requirements from a technical (Not GRC) perspective. Participate in and lead infrastructure lifecycle, security and technology projects. Provide 3rd Line / Major Incident support as a cybersecurity subject matter expert. Work with third-party suppliers and advise internal technical teams on security measures to resolve security and infrastructure issues. We're looking for experienced Cyber Security engineer with strong technical infrastructure knowledge and proven experience across incident response, threat monitoring and vulnerability management. You will possess: Extensive experience in a similar role blending Cyber Security with core Wintel Infrastructure and Azure cloud engineering. Strong knowledge of modern security architecture, threat prevention techniques and incident response. Strong Windows Server 2016/2019/2022 knowledge including Active Directory, DNS, DHCP, Intune, Group Policy, PKI, Entra and Azure SSO. Demonstrable experience across Cyber Security, Incident Response, Threat Monitoring and Vulnerability Management using tools such as MS Sentinel, MS Defender etc for threat hunting, vulnerability monitoring and security posture improvement. CISSP, CEH, CCNA Security, SC-100, SC200 or equivalent security certification. Experience designing, integrating and managing complex infrastructure and cloud solutions from a cyber security standpoint and advising technical infrastructure teams on security focussed designs and operations Strong communication skills with the ability to explain complex security issues to technical and non-technical audiences. Experience working with third-party providers across on-premise and cloud services. Strong planning skills and knowledge of ITIL processes and best practice. This is an excellent opportunity to join a highly regarded global organisation where you'll play a key role in strengthening cybersecurity across a complex international IT environment, combining hands-on security engineering, incident response and strategic infrastructure projects.
Comtecs Ltd
Ealing, London
Head of Information Security - CISSP, CISM, ISO27001, NIST, PCI DSS, GDPR, DevSecOps, Cloud Security, SIEM, SOC, AI Security. Permanent, West London, 4/1 Hybrid. c.£100k +Benefits Head of Information Security / CISO / Senior InfoSec Consultant required to lead and develop a modern, security-first function within a growing technology business. Reporting to the CTO, you'll combine strategic leadership with a hands-on technical approach, working closely with Engineering, Infrastructure and Operations teams to embed security across the organisation. The role will adopt Information Security strategy, governance, risk and compliance while implementing practical security controls, automation and DevSecOps best practice. This is an excellent opportunity to influence technology strategy, lead security initiatives and help shape a mature, AI-enabled security capability whilst remaining hands-on in the early stages. In time, you will build a small team of InfoSec and Cyber Security Analysts around you. Key Responsibilities: Define and deliver the Information Security strategy, policies and governance framework. Define and develop robust security controls inline with both business practices and compliance requirements inc ISO27001, CE+, SOC2, NIST CSF, GDPR and PCI DSS. Embed Secure by Design and DevSecOps principles across engineering teams. Lead cyber risk management, incident response, threat modelling and vulnerability management using a range of contemporary tools. Drive AI and automation to enhance security operations and threat detection. Oversee third-party security, supplier assurance and client audits. Recruit, mentor, lead and develop the Information Security team. As such we're looking for candidates with experience leading Information Security or Cyber Security functions within technology-led organisations. You will possess: CISSP, CISM or equivalent security certification. Strong knowledge of ISO27001, NIST, PCI DSS, GDPR and Information Security Governance. Experience developing security strategy, GRC and cyber risk programmes including definition of security controls Strong technical knowledge across cloud, network, endpoint, application and data security. Experience with SIEM, SOC, vulnerability management and incident response. Knowledge of DevSecOps, security automation and modern cloud environments. Excellent communication, stakeholder management and leadership skills. You may have been working as a CISO, Information Security Manager, Cyber Security Consultant or within another senior InfoSec/CyberSec capacity which has granted you experience in both security control definition and hands-on practical management of security threats and incidents including vulnerability scanning and penetration testing. This is an outstanding opportunity to join a forward-thinking medium sized global organisation where you'll shape the security strategy, influence technology direction and build a modern Information Security function using the latest cloud, automation and AI technologies. Location is commutable from West London, Middlesex, East Berkshire, North Surrey, South West London and parts of South London (Croydon etc). Accessible via District Line (West) and some mainline services.
Head of Information Security - CISSP, CISM, ISO27001, NIST, PCI DSS, GDPR, DevSecOps, Cloud Security, SIEM, SOC, AI Security. Permanent, West London, 4/1 Hybrid. c.£100k +Benefits Head of Information Security / CISO / Senior InfoSec Consultant required to lead and develop a modern, security-first function within a growing technology business. Reporting to the CTO, you'll combine strategic leadership with a hands-on technical approach, working closely with Engineering, Infrastructure and Operations teams to embed security across the organisation. The role will adopt Information Security strategy, governance, risk and compliance while implementing practical security controls, automation and DevSecOps best practice. This is an excellent opportunity to influence technology strategy, lead security initiatives and help shape a mature, AI-enabled security capability whilst remaining hands-on in the early stages. In time, you will build a small team of InfoSec and Cyber Security Analysts around you. Key Responsibilities: Define and deliver the Information Security strategy, policies and governance framework. Define and develop robust security controls inline with both business practices and compliance requirements inc ISO27001, CE+, SOC2, NIST CSF, GDPR and PCI DSS. Embed Secure by Design and DevSecOps principles across engineering teams. Lead cyber risk management, incident response, threat modelling and vulnerability management using a range of contemporary tools. Drive AI and automation to enhance security operations and threat detection. Oversee third-party security, supplier assurance and client audits. Recruit, mentor, lead and develop the Information Security team. As such we're looking for candidates with experience leading Information Security or Cyber Security functions within technology-led organisations. You will possess: CISSP, CISM or equivalent security certification. Strong knowledge of ISO27001, NIST, PCI DSS, GDPR and Information Security Governance. Experience developing security strategy, GRC and cyber risk programmes including definition of security controls Strong technical knowledge across cloud, network, endpoint, application and data security. Experience with SIEM, SOC, vulnerability management and incident response. Knowledge of DevSecOps, security automation and modern cloud environments. Excellent communication, stakeholder management and leadership skills. You may have been working as a CISO, Information Security Manager, Cyber Security Consultant or within another senior InfoSec/CyberSec capacity which has granted you experience in both security control definition and hands-on practical management of security threats and incidents including vulnerability scanning and penetration testing. This is an outstanding opportunity to join a forward-thinking medium sized global organisation where you'll shape the security strategy, influence technology direction and build a modern Information Security function using the latest cloud, automation and AI technologies. Location is commutable from West London, Middlesex, East Berkshire, North Surrey, South West London and parts of South London (Croydon etc). Accessible via District Line (West) and some mainline services.
