About the Role

The Vulnerability Program Manager owns how NetCov delivers vulnerability management and patching to our clients. Today that work is delivered differently from account to account, shaped by the practices each of our legacy companies brought with them. This role exists to turn that into one program: a defined service with a documented process, a predictable cadence, consistent reporting, and clear ownership of every step from discovery through verified remediation.

Reporting to the Director of Security Services, the Vulnerability Program Manager is the single point of accountability for the program. This is a hands-on role. The Program Manager is expected to run client vulnerability reviews personally, work directly in the tooling, and write the standards the rest of the team will follow, rather than managing the work from a distance.

The role sits at the center of a delivery chain the Program Manager does not fully control. Scanning data comes from multiple platforms, remediation is often executed by NetCov service desk and engineering teams or by the client themselves, and clients hold approval over their own change windows. Success therefore depends as much on building working rhythm and agreement with those groups as it does on the technical work.

Accountabilities

Program Definition and Standards

• Own the end-to-end vulnerability management and patching program, covering asset discovery, scanning, prioritization, remediation tracking, verification, and reporting.
• Define and document the standard service: scan frequency, patch cadence, severity-based remediation targets, exception and risk-acceptance handling, and the criteria for emergency out-of-band work.
• Establish and maintain the RACI for the program so it is clear which work belongs to the Vulnerability Analysts, security engineering, the service desk, and the client.
• Define ticket types, templates, and workflows in HaloPSA so that patch work, remediation work, and scan evidence are captured consistently and can be reported on.
• Set the standard for what constitutes acceptable evidence of remediation, including where a report rather than a ticket is the appropriate audit artifact.

Delivery Execution

• Run the recurring vulnerability management cadence for assigned clients, including monthly or quarterly review meetings, and hold the follow-through between meetings.
• Maintain a prioritized remediation backlog per client and drive it down, escalating stalled items rather than allowing them to age quietly.
• Coordinate remediation execution across NetCov delivery teams and client staff, including scheduling around change windows and maintenance periods.
• Manage exclusions, suppressions, and risk acceptances deliberately, ensuring that anything removed from a report is documented with a reason, an owner, and a review date.
• Serve as the escalation point for emergency vulnerability response, including zero-day and actively exploited issues that require out-of-cycle patching.

Client Engagement and Reporting

• Own the client-facing report catalog, including the recurring vulnerability review deck, aging and trend analysis, and executive summaries suitable for non-technical audiences.
• Present program status to client stakeholders and translate scan output into a clear picture of risk, progress, and what NetCov needs from the client to keep moving.
• Set and manage client expectations on scope, timelines, and division of responsibility, and document agreements so they survive staff changes on either side.
• Support client audit and compliance needs, including evidence requests tied to frameworks such as CMMC, PCI DSS, SOC 2, HIPAA, and NCUA examinations.
• Partner with Client Success and account teams during onboarding, escalations, and renewals, and provide the vulnerability management input those conversations require.

Tooling and Data Quality

• Own the operational configuration and health of the vulnerability management tool stack, including scanner coverage, credentialed scanning, agent deployment, and asset inventory accuracy.
• Work with security engineering to integrate scanning, ticketing, and patching platforms so that findings flow into client-visible reporting without manual rework.
• Identify and drive out sources of bad data, including stale assets, duplicate records, and unmanaged endpoints that distort client-facing counts.
• Identify automation opportunities across reporting, ticket creation, and remediation validation, and define the requirements for engineering to build against.

Continuous Improvement

• Define and report program metrics, including remediation SLA attainment, vulnerability aging, patch compliance rate, scan coverage, and recurring findings.
• Use those metrics to identify systemic problems rather than treating each client issue as isolated, and propose the process or tooling changes required to fix them.
• Train and mentor Vulnerability Analysts and other delivery staff on the standard process as the team is built out.
• Contribute to the ongoing definition and packaging of NetCov vulnerability management service offerings.

Program Scope

The Vulnerability Program Manager is accountable for the following areas of the Security Services portfolio:

• Vulnerability management delivery across the NetCov client base
• Patch management program and patching cadence
• Vulnerability and patch reporting, both client-facing and internal
• Asset discovery and inventory accuracy as it relates to scan coverage
• Remediation tracking, verification, and exception management

Perform other duties as assigned

Knowledge, Skills, and Abilities Required

• Demonstrated experience running vulnerability management and patching in a multi-client or multi-environment setting, ideally at an MSP or MSSP.
• Hands-on proficiency with vulnerability management and patching platforms such as InsightVM, ConnectSecure, NinjaOne, Datto RMM, or equivalent.
• Working knowledge of PSA and workflow tooling, HaloPSA preferred, including ticket design and reporting.
• Practical understanding of risk-based prioritization, including CVSS, exploit intelligence, and business context, and the judgment to apply it rather than defaulting to severity alone.
• Familiarity with compliance frameworks that drive vulnerability management requirements, including CMMC, PCI DSS, SOC 2, HIPAA, and NCUA examination expectations.
• Strong written and verbal communication skills, with a track record of running client meetings and presenting technical findings to non-technical stakeholders.
• Ability to drive work across teams without direct authority.
• Relevant certifications such as Security+, GIAC, CISSP, or vendor-specific credentials are preferred but not required.

Role Logistics

• Full-time, exempt position
• Standard business hours with flexibility around month-end close
• Occasional travel required for client engagement, team integration, and offsites