Role: Manager
- Threat & Vulnerability Management Role Summary The Threat & Vulnerability Management Lead will be responsible for establishing and driving the organization’s end-to-end vulnerability management and threat intelligence program. This role ensures proactive identification, assessment, prioritization, and remediation of security weaknesses across infrastructure, applications, cloud environments, and third-party ecosystems. The position requires a strong risk-based approach, deep understanding of the evolving threat landscape, and the ability to integrate vulnerability insights with enterprise risk, SOC operations, and business priorities.

Key Responsibilities
• Vulnerability Management Program Leadership
• Design, implement, and mature the enterprise-wide Vulnerability Management Program aligned with business risk appetite.
• Establish standardized processes for vulnerability identification, assessment, prioritization, remediation, and validation.
• Define and enforce risk-based remediation SLAs based on asset criticality and exposure.
• Oversee vulnerability scanning across networks, endpoints, databases, applications, APIs, and cloud platforms.
• Ensure coverage across internal assets, internet-facing systems, and third-party integrations.
• Threat Intelligence & Threat Management
• Establish and operationalize a Threat Intelligence capability to monitor emerging threats, attack vectors, and adversary tactics.
• Correlate threat intelligence with internal vulnerabilities to identify exploitable risks.
• Track global threat trends (e.g., ransomware, zero-day exploits, supply chain risks) and assess organizational exposure.
• Provide actionable threat insights to SOC, incident response,



and leadership teams.
• Risk-Based Prioritization & Remediation Governance
• Drive risk-based vulnerability prioritization using CVSS, exploitability, threat context, and business impact.
• Integrate vulnerability data with enterprise risk registers and GRC platforms.
• Work closely with IT, DevOps, cloud, and application teams to ensure timely remediation.
• Track remediation progress, exceptions, and compensating controls.
• Establish governance forums to review vulnerability posture and drive accountability.
• Application & Cloud Security Integration
• Collaborate with DevSecOps teams to embed vulnerability management into CI/CD pipelines.
• Oversee SAST, DAST, SCA, and container security scanning practices.
• Ensure cloud-native vulnerability management across IaaS, PaaS, and SaaS environments.
• Support secure configuration baselines and continuous posture management.
• Metrics, Reporting & Continuous Improvement
• Define and track key metrics such as vulnerability aging, remediation SLAs, exposure trends, and risk reduction.
• Develop dashboards and reports for senior leadership and board-level visibility.
• Conduct periodic program reviews, maturity assessments, and benchmarking against industry standards.
• Continuously enhance tools, processes, and automation capabilities.
• Red Teaming,



Threat Modeling & Proactive Testing
• Drive periodic penetration testing, red teaming, and adversary simulation exercises.
• Conduct threat modeling for critical applications, systems, and recent initiatives.
• Validate effectiveness of security controls against real-world attack scenarios.
• Stakeholder Management & Collaboration
• Partner with IT, Engineering, Cloud, SOC, Risk, and Compliance teams to ensure alignment.
• Act as a subject matter expert on vulnerability and threat management for internal stakeholders.
• Support audits, regulatory requirements, and third-party risk assessments. Preferred Certifications
• CISSP / CISM / CRISC
• CEH / OSCP (preferred for technical depth)
• GIAC certifications (e.g., GPEN, GWAPT, GCIH)
• ISO 27001 Lead Auditor / Implementer Key Competencies
• Risk-based decision-making and prioritization
• Strong analytical and problem-solving skills
• Deep understanding of threat landscape and attack methodologies
• Ability to translate technical risk into business impact
• Strong stakeholder management and influencing skills
• High ownership, accountability, and execution focus Requirements
• 8–12+ years of experience in cybersecurity, with strong focus on vulnerability management and threat intelligence.
• Experience in BFSI / Insurance sector preferred.
• Hands-on experience with vulnerability management tools (e.g., Qualys, Tenable, Rapid7, etc.).
• Strong understanding of enterprise architecture, cloud platform (Azure), and application security.
• Familiarity with regulatory expectations (e.g., IRDAI, RBI, ISO 27001, NIST CSF).

📌 Manager- Threat and Vulnerability Management (Hyderabad)
🏢 Kshema General Insurance
📍 Hyderabad