Vulnerability Management Technical Lead

• Own the definition and delivery of Gusto's vulnerability management and security operations programs across Security, AIT, R&D, Infrastructure, GRC, and Risk
• Set the strategy, roadmap, multi-quarter vision, intake, and prioritization for vulnerability management and security operations
• Lead delivery of centralized vulnerability management across code, cloud, data, and edge
• Deliver CSPM/DSPM, container scanning, dependency and secrets detection, and owner-based remediation routing through closure
• Expand high-risk security detection and alerting across systems and vendors
• Implement impersonation and privileged-access logging, SIEM integration, insider-risk telemetry, and agentic-activity logging
• Establish daily security-health and vulnerability-management dashboards and drive monthly reporting
• Build AI-plugin-driven security workflows for automated coverage checks and evidence collection
• Build plans, manage scope and risk, track milestones, and deliver audit and regulatory commitments
• Roll out controls including risk-scored PR review, JIT privileged access, and secrets management
• Support adoption through training, communications, and runbooks
• Align stakeholders through clear updates, manage vendors and partners, monitor work streams, budgets, tooling spend, and implementation costs

• History of taking programs from ambiguous to shipped in regulated environments
• 5 to 8+ years leading cross-functional TPM or delivery work
• Real time spent on security, infrastructure, or platform engineering
• Solid understanding of vulnerability management and security operations, including scanning coverage, remediation SLAs, detection engineering, SIEM/monitoring, identity, and privileged access
• AI plugins drive everyday delivery, with ability to help others work the same way
• Ability to speak the language of security engineering, infrastructure, GRC, and R&D
• Familiarity with vulnerability and asset scanners such as Wiz and Axonius
• Experience with dependency and secret scanning
• Familiarity with SIEM/detection tools such as Panther
• Familiarity with identity/JIT access tools such as Opal
• Hands-on experience using AI clients and plugins (MCPs)
• Working knowledge of SOC 1/2 and ISO 27001 control frameworks
• Secure SDLC practices
• PM certification (PMP, CAPM, Scrum, or Prosci) and experience in high-growth fintech or another regulated, fast-paced industry are nice to have

Demonstrates expertise in vulnerability management and security operations, with a strong focus on strategy development, cross-functional leadership, and regulatory compliance. Proficient in implementing security controls, managing risk, and utilizing AI-driven tools for enhanced security workflows.

• Vulnerability Management
• Security Operations
• Cross-Functional Leadership
• SIEM Integration
• PM Certification

• Vulnerability Management
• Security Operations
• Detection Engineering
• Remediation SLAs
• Scanning Coverage
• Secure SDLC Practices
• Dependency Scanning
• Secrets Management
• Privileged Access Management
• Risk Management

• Stakeholder Alignment
• Communication
• Training
• Vendor Management
• Cross-Functional Collaboration

• PMP
• CAPM
• Scrum
• Prosci

• Regulated Environments
• Fintech
• SOC 1/2
• ISO 27001
• Risk Scoring

• CSPM
• DSPM
• SIEM Tools
• Wiz
• Axonius
• Panther
• Opal
• AI Clients
• MCPs
• Dashboards