Core Responsibilities:

• Leads vulnerability risk management and remediation oversight across technology environments. Analyzes infrastructure vulnerability data to validate risk, applicability, ownership, remediation status, and reporting accuracy; identifies themes and actionable insights; and performs targeted outreach to drive resolution. 

• Develops and communicates vulnerability posture, trends, remediation deadlines, and material exposures to senior leadership. Monitors security dashboards and risk metrics, investigates reporting discrepancies, and improves reporting accuracy. 

• Serves as the technical risk liaison between GTO (Global Technology Operations) and security stakeholders, helping infrastructure operations teams navigate the security organization, clarify security dependencies, remove roadblocks, and enable strategic outcomes. 

• Translates technical findings into actionable business-risk information and advises technology teams on security requirements, risk-treatment decisions, and enterprise security initiatives. 

• Drives cross-functional remediation initiatives and coordinates resolution of high-risk security findings across GTO, Enterprise Security, infrastructure, application, engineering, technology owners, and supporting teams. 

• Partners with infrastructure, networking, platform, and other technology teams to perform root-cause analysis of vulnerabilities, identify security control or process gaps, and recommend security practices that help prevent, detect, and remediate future issues. 

• Develops and leads security assessment plans to evaluate the adequacy of information security controls. Identifies vulnerabilities, integration requirements and implications, emerging security needs, and appropriate corrective measures.  

• Works with IT subdivisions, third-party partners, and business units to assess and communicate security risks and the operational impacts of technology implementations. 

• Evaluates security requirements for data systems, networks, and websites; identifies enterprise technical security solutions; and coordinates adoption of security initiatives and solutions. 

• Facilitates escalation and resolution of vulnerabilities approaching remediation deadlines or requiring additional management attention and manages vendor relationships. 

• Maintains knowledge of emerging security practices, standards, policies, and industry trends and leads engagement and enablement of the Security Champion community. 

• Participates in special projects and performs other duties as assigned. 

Qualifications:

• Minimum eight years of related work experience. Experience in IT security or application development preferred. 

• Undergraduate degree in a related field or equivalent combination of training and experience.  

• Demonstrated experience interfacing with, presenting to, and reporting to senior-level leadership, with the ability to translate complex technical and security information into clear, actionable business-risk narratives. 

• Strong written and verbal communication skills, executive presence, and the ability to communicate effectively with technical and non-technical stakeholders. 

• Strong technical acumen and understanding of infrastructure and cloud operations, with the ability to effectively partner with infrastructure and other technical teams. 

• Knowledge of cybersecurity frameworks and security best practices, particularly NIST, with the ability to identify control and process gaps and recommend corrective actions. 

Preferred Experience & Skills:

• Previous experience as a Business Information Security Officer (BISO), IT Risk Manager, IT Controls Manager, or in a similar technical security governance and reporting role. 

• Experience supporting technology or infrastructure organizations in a security, risk, controls, or governance capacity. 

• Familiarity with cloud computing concepts and ITIL. 

• Familiarity with security and risk platforms such as Archer, Wiz, and Qualys. 

• Experience utilizing reporting and productivity tools such as Tableau and Microsoft 365. Tableau experience is preferred but not required. 

• Security certification such as ISC2 CISSP, GIAC Security Essentials Certification (GSEC), GIAC Penetration Tester Certification (GPEN), GIAC Web App Pen Tester (GWPN), or Certified Ethical Hacker (CEH) preferred. 

• Strong relationship-management, persuasion, and influencing capabilities across security and technology stakeholders.

Special Factors

Sponsorship

About Vanguard

At Vanguard, we don't just have a mission—we're on a mission.

To work for the long-term financial wellbeing of our clients. To lead through product and services that transform our clients' lives. To learn and develop our skills as individuals and as a team. From Malvern to Melbourne, our mission drives us forward and inspires us to be our best.

How We Work

Vanguard has implemented a hybrid working model for the majority of our crew members, designed to capture the benefits of enhanced flexibility while enabling in-person learning, collaboration, and connection. We believe our mission-driven and highly collaborative culture is a critical enabler to support long-term client outcomes and enrich the employee experience.