Senior Director, Exposure & Vulnerability Management

WTW Senior Director, Exposure & Vulnerability Management

WTW is seeking a Senior Director of Exposure & Vulnerability Management to lead WTW's vulnerability management security program. Reporting to the Global Head of Attack Surface Management, this leader owns the strategy, execution and evolution of enterprise exposure management capabilities spanning vulnerability operations, exposure validation, aligning with secure development (SAST/SCA/DAST) and risk intelligence, with a relentless focus on prioritization, business impact, mitigation strategies and measurable risk reduction.

The role partners closely with Corporate & Business Technology, Cloud Operations, Product, Platform Engineering, Risk Management, Privacy & Compliance, Managed Service Providers and Internal Audit stakeholders to ensure security findings are translated into actionable insight, aligned remediation priorities and demonstrably improved security outcomes across the enterprise. As a senior member of the Attack Surface Management leadership team, the Senior Director also acts as a strategic deputy to the Global Head, contributing to program direction, investment decisions, steering committee deliverables, and executive-level reporting.

The Role

As WTW continues to scale its digital platforms, client services and cloud estate, managing cyber risk requires more than identifying vulnerabilities. It requires understanding exposure, exploitability, reachability and business impact across infrastructure, cloud, identity, applications and the software supply chain.

The Exposure & Vulnerability Management function is accountable for transforming how security risk is identified, contextualized, validated and addressed across the enterprise. This includes shifting to a unified, continuous exposure management model that is aligned to Continuous Threat Exposure Management (CTEM) principles and built on an accurate, authoritative view of WTW's assets. The Senior Director will lead multi-disciplinary global teams while driving modernization across data, tooling, metrics, governance and engagement models.

The Responsibilities

Exposure Management Strategy & Program Leadership

• Define and own WTW's enterprise exposure & vulnerability management strategy and a multi-year roadmap that aligns infrastructure, cloud, application, identity and software supply chain risk into a unified risk view.
• Operationalize a continuous exposure & vulnerability management lifecycle (scoping, discovery, prioritization, validation and mobilization) aligned to CTEM principles.
• Track vulnerabilities via risk-based prioritization grounded in exploitability, threat intelligence, asset criticality, exposure and business impact.
• Establish clear ownership models, accountability and engagement patterns with technology and engineering teams to drive timely and effective remediation.
• Own the annual operating plan and budget for exposure & vulnerability management, building business cases for investment and demonstrating return in terms of risk reduction.

Discovery, Scoping & Asset Context

• Ensure continuous, comprehensive discovery of exposures across on-premises, cloud technologies, endpoints, IoT, SaaS and internet-facing attack surfaces.
• Partner with the Asset Management team to ensure exposure data is anchored to an accurate, authoritative asset inventory (CMDB), including ownership, business service mapping and criticality tiering.
• Ensure exposure coverage includes misconfigurations, cloud posture, identity and access weaknesses, external attack surface and unmanaged or shadow assets.

Risk-Based Prioritization & Exposure Validation

• Own and continuously refine WTW's risk-based vulnerability scoring and prioritization model, incorporating exploit prediction (e.g. EPSS), known-exploited intelligence (e.g. CISA KEV), threat intelligence, compensating controls and business context.
• Establish exposure validation capabilities, including attack path analysis, breach and attack simulation, and coordination with penetration testing and red team functions, to confirm real-world exploitability.
• Define and maintain risk-tiered remediation SLAs that differentiate by exposure, asset type and business criticality.

Vulnerability Operations & Remediation Mobilization

• Lead global teams responsible for vulnerability operations, ensuring consistent, scalable execution of discovery, validation, prioritization, tracking and closure across technology domains.
• Drive remediation mobilization through integrated workflows, clear hand-offs to owning teams and escalation paths for overdue or high-risk exposures.
• Lead WTW's response to critical and emerging vulnerabilities (e.g. zero-days and widely exploited flaws), coordinating rapid impact assessment, executive communication and accelerated remediation with Security Operations, Incident Response and Technology.
• Maintain availability for critical and emerging vulnerability events (e.g. zero-days), including participation in an on-call rotation or escalation structure to ensure rapid impact assessment and response outside of standard business hours.
• Own the vulnerability risk exception and acceptance process, ensuring exceptions are risk-assessed, time-bound, approved at the appropriate level and tracked to resolution.

Secure Development & Software Supply Chain (Partner to Application Security)

• Partner with Application Security and Business Technology leadership to embed SAST, DAST and SCA coverage and the broader application security toolchain (e.g., secrets detection, container and infrastructure-as-code scanning) — contributing risk-based prioritization methodology and ensuring application findings feed into the same risk-ranked queue as infrastructure and cloud exposures, rather than owning the toolchain itself.
• Support Application Security's efforts to embed security earlier in the SDLC by aligning exposure & vulnerability management's remediation workflow, SLAs, and reporting with their developer-friendly tooling and pipeline guardrails — extending consistent tracking and accountability to application-layer findings without taking on pipeline ownership.
• Collaborate with Application Security, Business Technology, and GRC to strengthen software supply chain risk management — including open-source governance and SBOM practices — providing exposure-management visibility, prioritization, and reporting rather than owning the program.

Governance, Regulatory & Risk Alignment

• Own the policies, standards and procedures governing vulnerability and exposure management, ensuring they are current, enforceable and consistently applied.
• Ensure the program meets regulatory and contractual obligations across WTW's operating jurisdictions, including DORA, NYDFS Part 500, GDPR and relevant client and industry requirements.
• Serve as the accountable lead for exposure & vulnerability management in engagements with regulators, Internal Audit, external auditors and client security assessments, and own remediation of related findings.
• Partner with Enterprise Risk and the second line to align exposure metrics with WTW's cyber risk appetite, key risk indicators and risk register.
• Assess and govern exposure risk introduced through acquisitions, divestitures and third-party or managed service providers.

Data, Metrics & Risk Intelligence

• Build and mature exposure-focused metrics and KRIs that enable leadership to understand risk posture, trends, remediation effectiveness and SLA performance.
• Partner with data and analytics teams to leverage security telemetry, automation and correlation across multiple data sources.
• Translate technical findings into clear, decision-ready insight for the CISO, executive leadership, risk committees and, where required, the Board.

Technology, Automation & Vendor Management

• Drive modernization of exposure & vulnerability management tooling, workflows and integrations, including consolidation and rationalization of overlapping tools.
• Identify and deliver opportunities for automation, orchestration and responsible use of AI to scale prioritization, triage and remediation.
• Partner with Product, Business Technology, Engineering, Cloud Operations, and Architecture teams to influence platform capabilities and security-by-design practices.
• Own vendor and managed service relationships for exposure & vulnerability management, including selection, contract governance and performance management.

Leadership, Talent & Stakeholder Engagement

• Lead, coach and develop high-performing teams across multiple disciplines and geographies, incl