Vulnerability Program Manager

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Vulnerability Program Manager based in the United States. This role owns the end-to-end delivery of vulnerability management and patching across a diverse client portfolio. You will establish consistent standards, processes, reporting, and accountability across multiple environments and delivery teams. The position combines hands-on cybersecurity operations with program leadership, client engagement, and continuous improvement. You will work directly with vulnerability management and patching tools while coordinating remediation across technical teams and client stakeholders. Your work will help organizations reduce cyber risk, meet compliance expectations, and maintain stronger security postures. The environment is collaborative and fast-paced, requiring strong influence and communication across teams that may not report directly to you. This is an opportunity to build and mature a scalable security service while making a measurable impact on client outcomes. Own the end-to-end vulnerability management and patching program, including asset discovery, scanning, risk-based prioritization, remediation tracking, verification, exception management, and reporting. Define and document standardized service processes, including scan frequency, patching cadence, severity-based remediation targets, risk acceptance procedures, and emergency response criteria. Establish clear roles and responsibilities across vulnerability analysts, security engineering, service desk teams, and client stakeholders. Design ticket types, templates, workflows, and reporting processes in PSA tooling to ensure vulnerability and patching activities are consistently documented. Run recurring vulnerability management reviews for assigned clients, maintain prioritized remediation backlogs, and proactively escalate stalled or aging findings. Coordinate remediation across internal delivery teams and client personnel, taking change windows, maintenance periods, and operational constraints into account. Manage exclusions, suppressions, and risk acceptances with appropriate documentation, ownership, rationale, and review dates. Act as the escalation point for urgent vulnerability response, including zero-day vulnerabilities and actively exploited threats requiring out-of-cycle remediation. Own client-facing vulnerability reporting, including recurring review materials, aging and trend analysis, and executive-level summaries. Present risk, remediation progress, and program status to technical and non-technical client stakeholders while clearly communicating responsibilities, dependencies, and required actions. Support audits and compliance requirements involving frameworks such as CMMC, PCI DSS, SOC 2, HIPAA, and NCUA examinations. Partner with client success and account teams during onboarding, escalations, renewals, and other client engagements. Maintain the operational health of vulnerability management tooling, including scanner coverage, credentialed scanning, agent deployment, and asset inventory accuracy. Collaborate with security engineering to integrate scanning, ticketing, and patching platforms and reduce manual reporting effort. Identify data-quality issues such as stale assets, duplicate records, and unmanaged endpoints that can affect vulnerability reporting. Define and track metrics including remediation SLA attainment, vulnerability aging, patch compliance, scan coverage, and recurring findings. Use program data to identify systemic issues and drive improvements to processes, tooling, automation, and service delivery. Train and mentor vulnerability analysts and other delivery personnel on standardized processes and contribute to the development of vulnerability management service offerings. Requirements: Demonstrated experience managing vulnerability management and patching programs across multiple clients or environments, pre