Senior Director, Cyber Exposure Management

Senior Director Cyber Exposure Management

Introduction to role:
Are you ready to turn exposure data into decisive action that protects the science manufacturing and digital platforms patients rely on every day Based in Gaithersburg Maryland you will own our enterprise understanding of vulnerabilities and weaknessesand drive closure before an attacker finds them. You will lead three complementary capabilities: Vulnerability Management Application Security and Penetration Testing/Red Team operating between builders and defenders to ensure our technology and platforms are resilient when it matters most.

This is a build-and-uplift mandate. You will move us from scan-and-ticket to modern risk-based exposure management; stand up application security as a true assurance function; and evolve offensive testing into a continuous intelligence-led capability. How would you partner across engineering cloud product and operations to prioritize real-world risk at machine speed and validate that our defenses work when it counts

Accountabilities:

Unified Exposure Strategy: Own and deliver a multi-year strategy across Vulnerability Management Application Security and Penetration Testing with clear roadmaps budgets and capability plans; set direction with a high degree of autonomy.

Risk-Based Vulnerability Management: Evolve from volume-based scanning to prioritized exposure management using asset criticality exploitability and threat intelligence; implement enterprise remediation governance and SLAs.

Attack Surface and Exposure Visibility: Maintain continuous visibility of internal and external attack surfacesincluding cloud SaaS and third-party exposureand focus effort where real-world risk is highest.

Application Security Assurance: Run a secure development assurance program covering SAST DAST and SCA; drive developer enablement and behaviors for software we build and buy.

Software Supply Chain Governance: Oversee software composition risk SBOM practices and rapid response to widely exploited components; guide investment and policy.

Continuous Offensive Testing: Operate a continuous program of penetration testing and adversary emulation across applications infrastructure cloud and OT; run purple-team exercises with Threat Management to harden detection and response.

AI-Era Exposure Readiness: Prepare for machine-speed exploit generation by automating discovery prioritization and validation; assess the security of AI and large language model systems.

Remediation Through Partners: Drive fixes through accountable asset owners; escalate and govern risk acceptance; keep the reporting honest and defensible.

Metrics and Executive Reporting: Own exposure KRIsmean time to remediate SLA attainment recurrence coverage critical exposure ageingand report credibly to senior leadership and risk committees.

Assurance Integration: Feed findings from offensive testing and cyber intelligence into prioritization; incorporate incident learnings so testing reflects how we are actually being attacked.

Executive Communication and Influence: Translate technical exposure into business risk the CISO IT leadership and the Board can act on; defend prioritization decisions under scrutiny.

Build and Uplift the Function: Lead and uplift a multi-disciplinary team of roughly eighteen across regions; raise posture from operational scanning to strategic exposure management while preserving independence and integrity.

Lead Through Leaders: Manage the leaders of Vulnerability Management Application Security and Penetration Testing; set objectives review performance and build succession.

Talent Culture and Capability: Recruit inclusively; develop career paths and upskilling in exposure management cloud and application security offensive testing and automation; leverage regional and external partnerships.

Budget and Tooling Ownership: Own budgets for scanning application security and offensive tooling and specialist partners; build the investment cases that maximize business risk reduction.

Essential Skills/Experience:

• Risk-based vulnerability management: Prioritization using asset criticality exploitability and intelligence; remediation governance and SLA management at enterprise scale.
• Application security: Secure SDLC SAST/DAST/SCA threat modelling API and cloud-native application security and developer enablement that changes behavior rather than just reporting findings.
• Offensive security: Penetration testing and adversary emulation across applications infrastructure cloud and OT and the use of purple teaming to improve detection.
• Attack surface and cloud: External and internal attack surface management across cloud SaaS and third-party exposure.
• Software supply chain: Open-source and third-party component risk SBOM practice and rapid response to widely exploited components.
• AI-era exploitation: How machine-speed vulnerability discovery and weaponization change prioritization and the security considerations of the organizations own AI systems.
• Regulated and OT context: Exposure management in GxP and OT/ICS environments where patching and testing are constrained by validation safety and uptime.
• Remediation through others: Driving fixes through asset-owning teams governing risk acceptance and keeping reporting defensible.
• Education: Bachelors degree or equivalent experience in information security computer science or a related field or equivalent practical experience.
• Depth: Ten or more years in cybersecurity including significant experience across vulnerability application or offensive security.
• Leadership scale: Five or more years leading exposure application security or offensive functions in a large enterprise including at least two years managing other people leaders.
• Program credibility: Demonstrable record of maturing a vulnerability or application security program and measurably reducing risk.
• Cross-functional delivery: Proven track record to drive remediation through teams you do not control across IT Cloud Engineering and business units.
• Communication and facilitation: Ability to explain exposure and prioritization in clear business terms and to brief senior executives and risk committees.
• Analytical decision making: Ability to prioritize finite remediation capacity against real-world risk and business pragmatism.
• Global coordination: Experience leading distributed teams across multiple regions and cultures.

Desirable Skills/Experience:

Certifications: CISSP CISM OSCP GIAC (GWAPT GPEN GXPN GCPN) or equivalent.
Sector experience: Pharmaceutical life sciences healthcare or another highly regulated industry with manufacturing OT exposure.
Board exposure: Experience briefing an audit committee board or risk committee on exposure and remediation.
Commercial: Experience selecting and governing scanning application security and offensive tooling and specialist testing partners.
Language: Working proficiency in a second language relevant to our delivery hubs.

When we put unexpected teams in the same room we unleash bold thinking with the power to inspire life-changing -person working gives us the platform we need to connect work at pace and challenge perceptions. Thats why we work on average a minimum of three days per week from the office. But that doesnt mean were not flexible. We balance the expectation of being in the office while respecting individual flexibility. Join us in our unique and ambitious world.

The annual base pay for this position ranges from $190956.80 - 286435.20 USD Annual and salaried non-exempt employees will also be paid overtime pay when working qualifying overtime hours. Base pay offered may vary depending on multiple individualized factors including market location job-related knowledge skills and addition our positions offer a short-term incentive bonus opportunity; eligibility to participate in our equity-based long-term incentive program.

Benefits offered included a qualified retirement program 401(k) plan; paid vacation and holidays; paid leaves; and health benefits including medical prescription drug dental and vision coverage in accordance with the terms and conditions of the applicable plans. Additional details of participation in these benefit plans will be provided if an employee receives an offer of employment. If hired employee will be in an at-will position and the Company reserves the right to modify base pay (as well as any other discretionary payment or compensation program) at any time including for reasons related to individual performance Company or individual department/team performance and market factors.

Why AstraZeneca:

Here technology and data power scientific discovery and the delivery of life-changing medicines to patients worldwide. You will join at a pivotal moment as we scale a modern digital enterpriseone that pairs pioneering platforms with a culture that values curiosity kindness and ambition in equal measure. Expect the room the resources and the partnerships to move fast: from collaborating with diverse experts to experimenting with new approaches learning every day and turning bold ideas into impact at global scale. Your leadership will directly shape how we protect critical research manufacturing and supply so our teams can focus on transforming patient outcomes.

If you are ready to build a modern exposure program that measurably reduces risk and safeguards vital science step forward and show us how you will lead this mission now!

Date Posted

Closing Date

Our mission is to build an inclusive environment where equal employment opportunities are available to all applicants and furtherance of that mission we welcome and consider applications from all qualified candidates regardless of their protected characteristics. If you have a disability or special need that requires accommodation please complete the corresponding section in the application form.