[Hiring] Director, Cyber Exposure & Vulnerability Management @Fifth Third Bank

Role Description

Fifth Third Bank is seeking a Director of Cyber Exposure & Vulnerability Management to lead two critical cybersecurity functions: Enterprise Vulnerability Remediation and Exposure Analysis & Coordination. This leader is responsible for reducing enterprise cyber risk by driving vulnerability remediation and coordinating the response to significant technology exposures across the Bank. The role combines strategic leadership and operational execution, partnering with senior technology leaders to prioritize remediation efforts, improve exposure management processes, and strengthen the Bank's cybersecurity posture.

In addition to leading the vulnerability remediation program, this Director will help mature a growing Exposure Analysis & Coordination capability focused on rapidly assessing and coordinating the Bank's response to emerging cybersecurity risks that require urgent action and cross-functional engagement. This is a highly visible leadership role that partners closely with Information Security, Technology, Risk Management, and executive leadership.

What You'll Do

• Lead Enterprise Vulnerability Remediation
  • Lead the enterprise vulnerability remediation program, including governance, reporting, escalation, and stakeholder coordination.
  • Partner with application, infrastructure, cloud, and security teams to drive timely risk reduction.
  • Establish remediation priorities, performance metrics, and service-level expectations.
  • Support audits, regulatory examinations, and enterprise risk governance activities.
  • Continuously improve remediation workflows, reporting, and prioritization processes.
• Lead Exposure Analysis & Coordination
  • Lead the Bank's Exposure Analysis & Coordination function.
  • Coordinate enterprise response to significant technology exposures, including:
    • Zero-day vulnerabilities
    • Emerging and pre-CVE threats
    • Vendor advisories
    • Third-party technology exposures
    • Cloud security exposures
  • Drive cross-functional assessment, prioritization, mitigation tracking, and executive communications.
  • Ensure significant exposure events are consistently governed, documented, escalated, and resolved.
  • Lead post-event reviews and operational improvements.
• Drive Risk-Based Decision Making
  • Translate vulnerability, threat, and exposure data into actionable risk decisions.
  • Advise senior leaders on remediation priorities, business impact, and risk tradeoffs.
  • Identify systemic issues and opportunities for long-term risk reduction.
• Lead Strategy & Continuous Improvement
  • Define strategy, roadmaps, metrics, and maturity objectives for the Remediation and Exposure Management functions.
  • Establish scalable operating processes, playbooks, and governance models.
  • Drive continuous improvement using Agile and Lean practices.
  • Align cybersecurity priorities with technology investment, capacity, and risk reduction objectives.
• Build High-Performing Teams
  • Lead and develop security engineers and analysts.
  • Coach emerging leaders and strengthen organizational capabilities.
  • Build a culture of accountability, collaboration, and continuous improvement.
  • Ensure teams can effectively support both planned remediation efforts and rapidly evolving cyber threats.

Qualifications

• 10+ years of experience in cybersecurity, technology risk, security operations, vulnerability management, or related disciplines.
• Experience leading enterprise-scale remediation, risk reduction, security operations, or response coordination programs.
• Strong knowledge of vulnerability management practices, risk prioritization methodologies, and cyber risk governance.
• Demonstrated ability to lead large cross-functional initiatives across complex organizations.
• Experience presenting to senior leaders and executive audiences.
• Strong executive communication and stakeholder management skills.
• Proven ability to influence outcomes without direct authority.
• Experience managing teams, budgets, priorities, and strategic initiatives.

Preferred Qualifications

• Experience within a large regulated financial services organization and FFIEC and PCI requirements.
• Experience supporting regulatory examinations, audits, and enterprise risk governance activities.
• Familiarity with vulnerability management, security analytics, asset management, GRC, and workflow management platforms.
• Experience with cloud, infrastructure, application, and third-party technology security.
• Experience operating within Agile or SAFe environments.
• Professional certifications such as CISSP, CISM, CRISC, GIAC, or equivalent.

Benefits

• Total Base Pay Range: 121,900.00 - 262,100.00 USD Annual
• Comprehensive benefits and differentiated compensation offerings to support employees' needs.
• Eligible to participate in an incentive compensation plan based on performance.

Company Description

Fifth Third Bank, National Association is proud to have an engaged and inclusive culture and to promote and ensure equal employment opportunity in all employment decisions regardless of race, color, gender, national origin, religion, age, disability, sexual orientation, gender identity, military status, veteran status or any other legally protected status.