Note: The job is a remote job and is open to candidates in USA. Avaya is seeking a Vulnerability Management Lead to advance vulnerability management and remediation across the cloud environments supporting its applications and services. The role leads vulnerability management engineers, drives cross-functional remediation, and strengthens security, risk management, and compliance practices.
Responsibilities
- Vulnerability Management & Remediation: Lead the identification, tracking, prioritization, and remediation of infrastructure and application vulnerabilities. Maintain visibility into the vulnerability portfolio and drive findings through resolution within established remediation timelines
- Team Leadership & Workload Management: Lead and develop the vulnerability management engineering team. Establish priorities, balance workloads, coordinate assignments, and provide technical guidance to support timely and effective remediation
- Risk Management & Compliance: Drive remediation activities aligned with enterprise risk requirements, security policies, and BOD 26-04 obligations. Partner with application owners, vendor managers, and risk stakeholders to resolve vulnerabilities within required time frames
- Security Operations & Incident Response: Represent infrastructure vulnerability management during incident calls involving application vulnerabilities. Coordinate escalations, communicate remediation status, and collaborate with security teams to address emerging risks and operational concerns
- Vulnerability Intelligence & Threat Analysis: Monitor industry trends, emerging vulnerabilities, threat intelligence, and adversary techniques to assess potential organizational impact. Apply knowledge of common attack vectors, intrusion techniques, and the MITRE ATT&CK framework to support vulnerability prioritization and risk reduction
- Security Monitoring & Technical Analysis: Leverage vulnerability assessment tools, SIEM platforms, network traffic analysis, and security event correlation to investigate findings, validate remediation progress, and identify potential security gaps
- Risk Metrics & Executive Reporting: Develop, maintain, and quality-assure monthly vulnerability and risk metrics for management and executive stakeholders. Provide clear visibility into remediation progress, outstanding risks, compliance status, and opportunities for continued improvement
- Process Engineering & Continuous Improvement: Identify gaps in vulnerability management processes, compliance controls, and operational workflows. Develop and implement improvements that strengthen remediation accountability, improve efficiency, and reduce recurring security issues
- Documentation & Knowledge Management: Create and maintain team processes, procedures, operational standards, and training documentation. Ensure vulnerability management practices are consistent, repeatable, and aligned with enterprise security objectives
- Training & Team Development: Support onboarding, training, and ongoing development of vulnerability management engineers. Promote knowledge sharing, technical consistency, and effective collaboration across cybersecurity and infrastructure teams
- Cross-Functional Collaboration: Partner with application engineering, infrastructure operations, security operations, vendor management, and risk teams to resolve technical and process-related challenges and maintain accurate vulnerability records in the system of record
- Operational Excellence & Technology Evolution: Evaluate emerging security tools, assessment methodologies, and industry practices to improve vulnerability detection, remediation workflows, and overall security program effectiveness
Skills
- Demonstrated ability to lead vulnerability management engineers, coordinate remediation activities, balance team workloads, and drive accountability across technical teams
- Hands-on experience with cybersecurity tools and technologies such as Qualys, Nessus, and Symantec, including vulnerability assessment, prioritization, tracking, and remediation
- Understanding of enterprise risk management, vulnerability remediation requirements, security controls, and compliance frameworks, including BOD 26-04, NIST CSF, NIST SP 800-53, ISO 27001, and PCI DSS ASV
- Knowledge of common attack vectors, adversary tactics and techniques, threat intelligence, security hardening, and the MITRE ATT&CK framework
- Experience with Security Information and Event Management (SIEM) platforms, including Splunk, security event correlation, monitoring programs, and investigation of security-related issues
- Ability to investigate complex security, network, system, and application issues; analyze network traffic and packets; and identify practical solutions to vulnerability and remediation challenges
- Experience maintaining vulnerability records, preparing risk metrics, supporting management reporting, and communicating remediation status and exposure to technical and executive stakeholders
- Ability to identify operational gaps, develop actionable solutions, establish repeatable processes, and build roadmaps that align vulnerability management activities with broader cybersecurity operations goals
- Strong written and verbal communication skills, with the ability to coordinate across teams, manage competing priorities, communicate technical findings, and drive remediation through resolution
- A bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field, or an equivalent combination of education and relevant experience
- Ability to manage multiple priorities and deadlines, work independently and collaboratively, and participate in after-hours and weekend on-call rotations as business needs require
- 6+ years of relevant IT or cybersecurity experience
- 5+ years of security experience with hands-on exposure to cybersecurity products such as Qualys, Symantec, or Nessus
- 3+ years of experience with Security Information and Event Management (SIEM) platforms
- 3+ years of experience supporting or analyzing adversary tactics and techniques using the MITRE ATT&CK framework
- Knowledge of cybersecurity standards and frameworks, including ISO 27001, NIST CSF, NIST SP 800-53, PCI DSS ASV, and BOD 26-04
- Strong written and verbal communication, organizational, analytical, and problem-solving skills
- Ability to coordinate multiple initiatives, manage competing priorities, and drive remediation activities across cross-functional teams
- Ability to support after-hours and weekend on-call rotations as required
- Applicants must be currently authorized to work in the United States without the need for visa sponsorship now or in the future
- Experience with cloud enterprise security tools, risk assessment methodologies, security controls, and vulnerability management in SaaS or other cloud-based environments
- Experience with URL filtering, web proxy technologies, network troubleshooting, packet analysis, and network security controls
- Demonstrated experience developing management presentations, executive dashboards, and operational reporting using tools such as PowerPoint and Visio
- Familiarity with vulnerability remediation mandates, security compliance requirements, and enterprise risk reporting, particularly BOD 26-04
- A track record of improving remediation timelines, reducing outstanding vulnerabilities, strengthening compliance, and delivering measurable reductions in security risk over time
- Industry-recognized cybersecurity certification in one or more of the following: CompTIA Security+, CISSP, GIAC, or GCIH
- Experience with URL filtering, web proxy technologies, and troubleshooting
- Experience creating executive presentations, developing risk metrics, and supporting management reporting
- Demonstrated ability to improve vulnerability remediation timelines and deliver sustained, measurable reductions in organizational risk
Company Overview