Director, Technical Vulnerability Management & Remediation Orchestration

Job Title: Director, Technical Vulnerability Management & Remediation Orchestration

Reporting to: SVP, Infrastructure & Enterprise Technology

Location: NYC

Type: Hybrid 3 days a week in office

Pay Range: $190,000 - $220,000 + Bonus

The Director of Technical Vulnerability Management (VM) & Remediation Orchestration is the global operational leader responsible for defining, driving, and scaling News Corps enterprise vulnerability remediation strategy. Reporting directly to the SVP, Infrastructure & Enterprise Technology, you will lead the central Vulnerability Remediation Services function, serving as the connective operational bridge between Enterprise Cyber Security, Technology Operations / Service Management, Infrastructure, and Business Unit (BU) leadershipincluding platform owners across Dow Jones, HarperCollins, Realtor.com, News Corp Australia, News UK, New York Post, News Corp HQ, and Global Technology.

In this role, you will strategically partner with Cyber Security (owners of core VM scanning tools and policy) and Tech Ops / Service Delivery (owners of the CMDB and asset topology) to ingest and leverage up-to-date, normalized risk data enabling presentation to platform owners.

Your core mandate is to leverage and mature existing reporting and ticket orchestration, driving remediation and compliance through defined Continuous Threat Exposure Management (CTEM) frameworks, ensure SLA compliance, and facilitate cadence-based reporting with Global Tech and business partners.

Key Responsibilities

Strategic Leadership, Governance and Cross-Functional Partnerships

• Establish and execute a unified, global vulnerability remediation management strategy spanning cloud (AWS, Azure, GCP), infrastructure, applications, containerized workloads, and edge systems, leveraging Continuous Threat Exposure Management (CTEM) principles to systematically scope, discover, prioritize, validate, and mobilize remediation.
• Define and maintain enterprise-wide VM remediation processes, and associated SLAs tailored to asset criticality and business context.
• Partner with BU executives, engineering heads, and IT directors to align VM remediation policies and findings against operational constraints and product roadmaps.
• Act as primary operational partner with defined BU VM Champions and technical leads, providing actionable insights and highlighting bottlenecks in meeting remediation SLAs
• Partner with Cyber Security leads to continuously evaluate scanning coverage (SAST/DAST/SCA, CSPM, EASM) to ensure vulnerability detection feeds align with evolving threat models, policy requirements, and vendor consolidation strategy to maximize ROI.

• Establish and govern standardized global vulnerability remediation workflows, patch windows, maintenance schedules and remediation cadences across all critical infrastructure and application tiers, driving consistent accountability across global BUs.
• Establish and maintain an enterprise Responsibility Matrix (RACI) clearly defining ownership and handoffs between centralized vulnerability management, cyber security functions, shared infrastructure services and BU-managed platforms.
• Partner with BU engineering and operations leadership to define, document and operationalize localized patch regimens and asset lifecycle management plans, including roadmaps for legacy End-of-Life (EOL) and Out-of-Service-Life technologies.
• Design, implement and maintain automated remediation workflows in Jira /ServiceNow, translating normalized findings from defined scanning tools into clear, prioritized actionable items assigned to system and application owners.
• Lead global cross-BU governance meetings and vulnerability steering committees to track outstanding issues, resolve resource bottlenecks and drive continuous alignment.
• Establish formal risk-acceptance and escalation governance pathways for unresolved risks, aged vulnerabilities, and exceptions, presenting structured risk-acceptance profiles and formal exposure reviews to executive leadership and risk committees.

• Partner with the Cyber Security function to ensure appropriate tooling is in place for the evaluation, implementation, and management of modern vulnerability identification tools (DAST, SAST, SCA, CSPM, EASM).
• Shift from reactive patching to risk-based vulnerability management (RBVM) and exposure validation, utilizing threat intelligence, exploitability data (EPSS, KEV), and business impact to prioritize remediation efforts across high-value asset environments.
• Coordinate with platform owners to monitor vendor security advisories, CVEs, product updates and EOL notifications alongside Cyber Security scanning, ensuring emerging threats and vulnerabilities are assessed, owned and remediated appropriately.
• Coordinate vendor architectural reviews with platform owners to identify security misconfigurations, architectural weaknesses and design vulnerabilities, ensuring findings are risk assessed, prioritised and remediated.

• Drive the use of automation and AI across VM, improving asset identification, CMDB accuracy, scanning, remediation and reporting.
• In partnership with Cyber Security, evaluate, consolidate, and rationalize vendor security tooling and platforms across BUs to reduce operational complexity, ensure architectural consistency, and maximize return on security investments (ROI).
• Lead root-cause analysis of recurring systemic vulnerabilities, championing DevSecOps principles and embedding automated security gates and shift-left controls within CI/CD pipelines to prevent security regressions early in the development lifecycle.

• Define and monitor VM KPIs and KRIs, delivering measurable 612 month performance improvementsincluding a target reduction in Mean Time to Remediate (MTTR) for critical/high vulnerabilities and achieving 90%+ SLA compliance across all business units.
• Develop global and BU VM risk dashboards and executive reporting for the CISO, CTO, Risk Committee and Board, highlighting key vulnerabilities, trends, remediation progress and residual risk.

• Experience: 10+ years in Information Technology with heavy involvement across Security, IT Risk or Cybersecurity operations, including 5+ years in a global leadership or Director-level role managing enterprise vulnerability programs.
• Domain Expertise: Deep expertise in enterprise VM, remediation orchestration, patch management, risk-based prioritisation and vulnerability detection across complex IT and cloud environments.
• Cross-Functional Leadership: Proven ability to influence engineering, DevOps, technology and business teams in a global matrixed organisation without direct line authority.
• Communication & Stakeholder Management: Exceptional ability to translate complex technical risks into clear, business-focused insights for senior executives and Board-level stakeholders.
• Technical Acumen: Strong understanding of modern VM, security and orchestration technologies, including platforms such as Qualys, Tenable, Wiz, Snyk, Defender for Cloud, Jira and ServiceNow.
• Education & Credentials: Bachelors degree in Computer Science, Information Technology or related field; relevant certifications such as CISSP, CISM or CRISC highly desirable.

Were committed to offering competitive and flexible compensation to attract top talent. This pay range reflects our good faith estimate for the role and may vary based on a candidates experience, skills, location, and other relevant factors.

For bonus-eligible roles, targets are determined based on multiple considerations, including market benchmarks and individual contributions.

For benefits-eligible roles, we offer a comprehensive and competitive benefits package covering health, retirement, wellbeing, and more, along with optional benefits to meet the diverse needs of our employees