Senior Technology Manager - Vulnerability Management and Application Security

Senior Technology Manager - Vulnerability Management and Application Security who we are

lululemon is an innovative performance apparel company for yoga, running, training, and other athletic pursuits. Setting the bar in technical fabrics and functional design, we create transformational products and experiences that support people in moving, growing, connecting, and being well. We owe our success to our innovative product, emphasis on stores, commitment to our people, and the incredible connections we make in every community we're in.

As a company, we focus on creating positive change to build a healthier, thriving future. In particular, that includes creating an equitable, inclusive and growth-focused environment for our people.

As the Senior Technology Manager for Vulnerability Management and Application Security, you will be a key leader within the Technology organization, responsible for shaping and executing the vision for secure, resilient, and compliant application ecosystems across a rapidly scaling global business. You will lead a team of security engineers and program managers focused on embedding vulnerability management and secure development practices into every layer of our technology stack.

As the leader of this team, you will drive the development and implementation of security frameworks, controls, and tooling that support proactive risk identification, remediation, and governance across applications and infrastructure. You will partner closely with engineering, product, and compliance teams to ensure our platforms are not only innovative but also defensible and aligned with regulatory expectations.

• Leadership & Strategy – develop, lead, and mentor a team of security engineers and PMs/scrum leads focused on identifying and prioritizing vulnerabilities in our environment, and working with application teams on remediations
• Vulnerability Identification and Prioritization – Lead the identification, categorization, and prioritization of security vulnerabilities using CVSS scoring, business impact assessments, and threat modeling frameworks
• Application Security Oversight – Embed secure development practices across the SDLC, including threat modeling, secure coding, and Dev Sec Ops  integration, ensuring alignment with regulatory frameworks
• Security Strategy & Architecture – define and execute the security strategy for vulnerability management and application security aligned with enterprise risk, GRC, and business goals and objectives
• Technical Guidance and Execution – provide hands‑on technical leadership in designing and implementing security controls, scanning for vulnerabilities, guide threat modelling, vulnerability assessments, and secure designs for our cloud environments and applications
• Governance and Compliance Alignment – collaborate with GRC and legal teams to ensure vulnerability management practices align with internal policies and external compliance requirements
• Reporting and Metrics – produce operational reports on vulnerability status, risk exceptions, and remediation progress, providing visibility to leadership and informing strategic decisions
• Security Tooling and Automation – scale vulnerability remediation through automation and integrations with scanning tools and lead efforts to operationalize detection and response capabilities
• Vendor partnership & management – evaluate, onboard, and manage third‑party vendors and tools related to vulnerability management and application security; ensure vendor solutions meet internal security standards and risk due diligence processes
• Budget management – develop and manage the team’s operational and project budgets, ensuring alignment with strategic priorities; track and report on budget performance identifying opportunities for cost optimization

• 8-10 years of experience enabling key business priorities through the successful delivery and support of cyber programs and initiatives
• Deep understanding of regulatory frameworks including NIST, SOX, PCI, GDPR and other global data privacy regulations with the ability to translate these into actionable technical and operational controls
• Pr…