Vulnerability Management Manager (Virtual, US)

About Avaya

Avaya is an enterprise software leader that helps the world’s largest organizations and government agencies forge unbreakable connections.

The Avaya Infinity™ platform unifies fragmented customer experiences, connecting the channels, insights, technologies, and workflows that together create enduring customer and employee relationships.

We believe success is built through strong connections – with each other, with our work, and with our mission. At Avaya, you'll find a community that values your contributions and supports your growth every step of the way.

Learn more at

Job Description

Reduce Risk. Accelerate Remediation. Strengthen Security.

Are you passionate about reducing cybersecurity risk, improving vulnerability remediation, and leading teams that strengthen enterprise security? Do you believe in proactive risk management, operational excellence, and using actionable security intelligence to drive measurable improvements? We’re looking for a Vulnerability Management Lead to help advance vulnerability management and remediation across the cloud environments that support our applications and services.

The Opportunity

As a Vulnerability Management Lead, you’ll lead a team of vulnerability management engineers responsible for identifying, tracking, prioritizing, and driving vulnerabilities through remediation to resolution. You’ll collaborate with application owners, infrastructure teams, vendor managers, and security partners to reduce exposure, accelerate remediation timelines, and strengthen the security posture of a SaaS cloud environment supporting Unified Communications (UC) services.

You’ll help align vulnerability remediation with enterprise security standards, risk management objectives, and BOD 26-04 requirements. Working across security operations, application engineering, and infrastructure teams, you’ll use vulnerability intelligence, security monitoring, and risk metrics to identify gaps, improve processes, and drive measurable reductions in technology risk.

This role is ideal for a security leader who enjoys solving complex technical challenges, coordinating cross-functional teams, improving operational effectiveness, and building repeatable processes that deliver lasting security improvements.

Your Mission-Critical Responsibilities

Vulnerability Management & Remediation: Lead the identification, tracking, prioritization, and remediation of infrastructure and application vulnerabilities. Maintain visibility into the vulnerability portfolio and drive findings through resolution within established remediation timelines.

Team Leadership & Workload Management: Lead and develop the vulnerability management engineering team. Establish priorities, balance workloads, coordinate assignments, and provide technical guidance to support timely and effective remediation.

Risk Management & Compliance: Drive remediation activities aligned with enterprise risk requirements, security policies, and BOD 26-04 obligations. Partner with application owners, vendor managers, and risk stakeholders to resolve vulnerabilities within required time frames.

Security Operations & Incident Response: Represent infrastructure vulnerability management during incident calls involving application vulnerabilities. Coordinate escalations, communicate remediation status, and collaborate with security teams to address emerging risks and operational concerns.

Vulnerability Intelligence & Threat Analysis: Monitor industry trends, emerging vulnerabilities, threat intelligence, and adversary techniques to assess potential organizational impact. Apply knowledge of common attack vectors, intrusion techniques, and the MITRE ATT&CK framework to support vulnerability prioritization and risk reduction.

Security Monitoring & Technical Analysis: Leverage vulnerability assessment tools, SIEM platforms, network traffic analysis, and security event correlation to investigate findings, validate remediation progress, and identify potential security gaps.

Risk Metrics & Executive Reporting: Develop, maintain, and quality-assure monthly vulnerability and risk metrics for management and executive stakeholders. Provide clear visibility into remediation progress, outstanding risks, compliance status, and opportunities for continued improvement.

Process Engineering & Continuous Improvement: Identify gaps in vulnerability management processes, compliance controls, and operational workflows. Develop and implement improvements that strengthen remediation accountability, improve efficiency, and reduce recurring security issues.

Documentation & Knowledge Management: Create and maintain team processes, procedures, operational standards, and training documentation. Ensure vulnerability management practices are consistent, repeatable, and aligned with enterprise security objectives.

Training & Team Development: Support onboarding, training, and ongoing development of vulnerability management engineers. Promote knowledge sharing, technical consistency, and effective collaboration across cybersecurity and infrastructure teams.

Cross-Functional Collaboration: Partner with application engineering, infrastructure operations, security operations, vendor management, and risk teams to resolve technical and process-related challenges and maintain accurate vulnerability records in the system of record.

Operational Excellence & Technology Evolution: Evaluate emerging security tools, assessment methodologies, and industry practices to improve vulnerability detection, remediation workflows, and overall security program effectiveness.

What You Bring to the Team

• The Security Leader: Demonstrated ability to lead vulnerability management engineers, coordinate remediation activities, balance team workloads, and drive accountability across technical teams.
• The Vulnerability Management Expert: Hands-on experience with cybersecurity tools and technologies such as Qualys, Nessus, and Symantec, including vulnerability assessment, prioritization, tracking, and remediation.
• The Risk Management Mindset: Understanding of enterprise risk management, vulnerability remediation requirements, security controls, and compliance frameworks, including BOD 26-04, NIST CSF, NIST SP 800-53, ISO 27001, and PCI DSS ASV.
• The Threat Intelligence Foundation: Knowledge of common attack vectors, adversary tactics and techniques, threat intelligence, security hardening, and the MITRE ATT&CK framework.
• The Security Operations Toolkit: Experience with Security Information and Event Management (SIEM) platforms, including Splunk, security event correlation, monitoring programs, and investigation of security-related issues.
• The Technical Troubleshooter: Ability to investigate complex security, network, system, and application issues; analyze network traffic and packets; and identify practical solutions to vulnerability and remediation challenges.
• The Compliance and Reporting Partner: Experience maintaining vulnerability records, preparing risk metrics, supporting management reporting, and communicating remediation status and exposure to technical and executive stakeholders.
• The Process Improvement Driver: Ability to identify operational gaps, develop actionable solutions, establish repeatable processes, and build roadmaps that align vulnerability management activities with broader cybersecurity operations goals.
• The Collaborative Communicator: Strong written and verbal communication skills, with the ability to coordinate across teams, manage competing priorities, communicate technical findings, and drive remediation through resolution.
• The Technical Foundation: A bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field, or an equivalent combination of education and relevant experience.
• The Operationally Ready Professional: Ability to manage multiple priorities and deadlines, work independently and collaboratively, and participate in after-hours and weekend on-call rotations as business needs require.

Extra Credit (The Nice-to-Haves)

• Security Certifications: Industry-recognized cybersecurity certifications such as CompTIA Security+, CISSP, GIAC certifications, or GCIH.
• Cloud Security & Risk Assessment: Experience with cloud enterprise security tools, risk assessment methodologies, security controls, and vulnerability management in SaaS or other cloud-based environments.
• Security Proxy & Network Analysis: Experience with URL filtering, web proxy technologies, network troubleshooting, packet analysis, and network security controls.
• Executive Reporting & Visualization: Demonstrated experience developing management presentations, executive dashboards, and operational reporting using tools such as PowerPoint and Visio.
• Regulatory & Compliance Expertise: Familiarity with vulnerability remediation mandates, security compliance requirements, and enterprise risk reporting, particularly BOD 26-04
• Operational Excellence: A track record of improving remediation timelines, reducing outstanding vulnerabilities, strengthening compliance, and delivering measurable reductions in security risk over time.

Why Join Us?

Meaningful Security Challenges: Help protect cloud-based Unified Communications services by reducing vulnerabilities and strengthening enterprise security.

Security Leadership & Impact: Lead a team of engineers and collaborate across application, infrastructure, and security organizations to drive measurable improvements in risk reduction.

Data-Driven Risk Management: Use vulnerability intelligence, security monitoring, and executive metrics to prioritize remediation and improve security decision-making.

Continuous Improvement: Shape vulnerability management processes, strengthen compliance practices, and implement solutions that improve operational efficiency and security outcomes.

Collaborative Cybersecurity Operations: Work with cross-functional teams to resolve complex technical challenges, improve remediation accountability, and advance cybersecurity operations.

A Culture of Operational Excellence: Help establish scalable, repeatable vulnerability management practices that support a more secure, resilient, and compliant cloud environment.

Required Qualifications

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field, or an equivalent combination of education and relevant experience.
• 6+ years of relevant IT or cybersecurity experience.
• 5+ years of security experience with hands-on exposure to cybersecurity products such as Qualys, Symantec, or Nessus.
• 3+ years of experience with Security Information and Event Management (SIEM) platforms.
• 3+ years of experience supporting or analyzing adversary tactics and techniques using the MITRE ATT&CK framework.
• Knowledge of cybersecurity standards and frameworks, including ISO 27001, NIST CSF, NIST SP 800-53, PCI DSS ASV, and BOD 26-04.
• Strong written and verbal communication, organizational, analytical, and problem-solving skills.
• Ability to coordinate multiple initiatives, manage competing priorities, and drive remediation activities across cross-functional teams.
• Ability to support after-hours and weekend on-call rotations as required.

Preferred Qualifications

• Industry-recognized cybersecurity certification in one or more of the following: CompTIA Security+, CISSP, GIAC, or GCIH.
• Experience with URL filtering, web proxy technologies, and troubleshooting.
• Experience creating executive presentations, developing risk metrics, and supporting management reporting.
• Demonstrated ability to improve vulnerability remediation timelines and deliver sustained, measurable reductions in organizational risk

The pay range for this opportunity is up to $193,869 in total compensation, inclusive of base salary and bonus. Actual total compensation will vary based on factors such as a candidate’s qualifications, skills, competencies, and relevant experience.

Experience

Education

Preferred Certifications

Footer

Applicants must be currently authorized to work in the United States without the need for visa sponsorship now or in the future.

Avaya is an Equal Opportunity employer and a U.S. Federal Contractor. Our commitment to equality is a core value of Avaya. All qualified applicants and employees receive equal treatment without consideration for race, religion, sex, age, sexual orientation, gender identity, national origin, disability, status as a protected veteran or any other protected characteristic. In general, positions at Avaya require the ability to communicate and use office technology effectively. Physical requirements may vary by assigned work location. This job brief/description is subject to change. Nothing in this job description restricts Avaya right to alter the duties and responsibilities of this position at any time for any reason.