Vulnerability Manager

Runs BeyondTrust's product vulnerability management program from end to end, as the person accountable for knowing the company's open vulnerability risk at any moment. The main focus is vulnerability management under FedRAMP 20x and bringing new products into the program as they launch. The posting describes it as an operator role rather than one with a team.

The manager designs and runs the full process, from intake and triage through SLA tracking, exceptions and verified closure. For FedRAMP 20x that means a regular monitoring rhythm, evidence that machines can read, reporting on Key Security Indicators and managing POA&Ms until they close. Findings are ranked by how exploitable and exposed they are, how critical the asset is and what other controls apply, not by CVSS score alone, and the manager defends those rankings to engineers, executives and assessors. They push remediation with product engineering teams, escalate overdue critical and high findings, treat risk acceptances as decisions that expire, and lead the response to zero-days and actively exploited flaws. Security Engineering builds the platform integrations to the requirements this role writes, while the manager automates the process itself with scripting and AI-assisted triage, and reports metrics such as SLA attainment and mean time to remediate.

BeyondTrust wants at least five years across vulnerability management, product security or security operations, including having owned (not just taken part in) a vulnerability process in a regulated or audited setting, familiarity with FedRAMP and NIST SP 800-53, hands-on exposure management, CSPM, container and SCA tooling, Python scripting, and a solid grasp of KEV, EPSS and risk-based prioritisation. Fully remote, North America only.