Role Title: Sr. Manager – Threat & Vulnerability Management

Location: Bangalore

ABOUT UNILEVER
With 3.4 billion people in over 190 countries using our products every day, Unilever is a business that makes a real impact on the world. Work on brands that are loved and improve the lives of our consumers and the communities around us. We are driven by our purpose: to make sustainable living commonplace, and it is our belief that doing business the right way drives superior performance. At the heart of what we do is our people – we believe that when our people work with purpose, we will create a better business and a better world.
At Unilever, your career will be a unique journey, grounded in our inclusive, collaborative, and flexible working environment. We don’t believe in the ‘one size fits all’ approach and instead we will equip you with the tools you need to shape your own future.

ABOUT GDT: 

GDT is the global digital and technology engine of Unilever offering business services, technology, and enterprise solutions. GDT serves over 190 locations and through a network of specialized service lines and partners delivers insights and innovations, user experiences and end-to-end seamless delivery making Unilever Purpose Led and Future Fit. 

Role Purpose:

This role leads the execution, governance, and continuous improvement of Unilever’s enterprise Threat & Vulnerability Management program across cloud-native, on-premises, endpoints, network, and factory/OT environments. The role combines technical depth in infrastructure and cloud, Applications/APIs, AI agents & Saas with large-scale remediation program leadership, risk-based prioritisation, AI first strategies, vendor governance, and measurable reduction of cyber risk.

Role Summary:

The Threat & Vulnerability Management leader – reporting to Director of Proactive Security - is responsible for driving a structured, risk-based vulnerability management program globally, aligned to enterprise security strategy, regulatory requirements, and industry standards. This includes end-to-end ownership of vulnerability identification, prioritisation, remediation governance, exceptions, and reporting across cloud-native workloads, on-premises infrastructure, endpoints, network devices, Applications/ APIs, Saas, AI agents and factory/OT technology.

The leader will establish and manage SOPs, policies, standards, KPIs, cross functional & business relationship, vendor management and executive reporting for vulnerability management. The role will drive effective use and integration of CNAPP and vulnerability technologies, including Wiz (preferred), Qualys, and CrowdStrike, while collaborating with Cloud, Infrastructure, Endpoint, Network, Factory/OT, GRC, and business technology teams to accelerate remediation and embed security by design.

Main Accountabilities

• Responsible to manage the enterprise global Threat & Vulnerability Management program, including strategy, planning, execution, governance, and continuous improvement.
• Lead the end-to-end vulnerability lifecycle across cloud-native, on-premises, endpoints, network, and factory/OT environments, manage MSSP
• Lead large-scale, cross-functional remediation programs, establishing clear ownership, milestones, escalation routes, SLAs, KPIs, and measurable risk reduction.
• Drive risk-based prioritisation using active exploitation, threat intelligence, internet exposure, asset criticality, attack paths, and potential business impact.
• Provide technical leadership across infrastructure and cloud vulnerability management, including operating systems, middleware, containers, Kubernetes, virtualisation, and network infrastructure.
• AI native tech implementation and design influences and vul management for AI.
• Drive effective use and integration of CNAPP, Wiz, Qualys, CrowdStrike, and other security telemetry to improve coverage, correlation, and actionable prioritisation.
• Identify recurring and systemic vulnerability patterns and influence platform and engineering teams toward hardened configurations, golden images, secure builds, preventive guardrails, and sustainable fixes.
• Partner with Cloud, Infrastructure, Endpoint, Network, Factory/OT, Cyber Security, and business technology teams, while managing strategic vendors and service partners for delivery quality and continuous improvement.

Key Skills and Relevant Experience

Skills:

• Deep expertise in enterprise vulnerability and exposure management, including risk-based prioritisation, remediation governance, and sustainable risk reduction.
• Strong technical understanding of infrastructure and cloud architecture, covering cloud-native platforms, on-premises infrastructure, endpoints, networks, and factory/OT environments and AI agent, applications/APIs
• Ability to evaluate vulnerability risk using exploitability, threat context, exposure, asset criticality, and attack paths, rather than severity alone.
• Strong knowledge of CNAPP and enterprise security tooling, with experience of platforms such as Wiz, Qualys, and CrowdStrike.
• Ability to identify systemic security weaknesses and influence architecture, platform hardening, secure configuration, and preventive controls.
• Strong program leadership and stakeholder management, with the ability to influence technical teams and senior stakeholders across a complex global organisation.

Experience:

• 15+ years in cybersecurity or infrastructure security, with substantial experience in enterprise Threat & Vulnerability Management.
• Proven track record of leading large-scale vulnerability and remediation programs across complex, geographically distributed technology environments.
• Experience working with cloud, infrastructure, engineering, endpoint, network, and factory/OT teams to drive remediation and long-term risk reduction.
• Demonstrated success operating within a global matrix organisation, driving outcomes across teams where ownership and accountability are distributed.
• Experience managing strategic technology/service partners, governance, performance, and executive-level reporting.
• Relevant certifications such as CISSP, CCSP, GIAC, or cloud security certifications are advantageous.

Mandatory skills:

• 15+ years in cybersecurity or infrastructure security,
• End to end Vulnerability management exp for large scale,
• CNAPP, CSPM for cloud
• Hand on on-premises infrastructure security, people management, KPIs, Qualys / Tenable or Wiz/ CRowdstike experience

Good to Have skills:

• Work exp in global organisation or GCC
• Saas Products experience,
• MSSP management, Factory OT etc

LEADERSHIP SKILLS 

• CARE DEEPLY: We care about how consumers experience our brands, the growth and development of our people, and their impact on the planet. We emphasize the importance of performance and care, moving from ambiguity about success to fairness and transparency. 

• FOCUS ON WHAT COUNTS: We prioritize what truly matters, setting clear and stretching goals. We aim to shift from having everything as a priority to focusing on fewer, bigger things that are delivered to conclusion and are being rewarded. 

• STAY THREE STEPS AHEAD: We encourage bold and creative thinking to make breakthroughs in performance. We focus on anticipating and staying ahead of consumer needs and external trends, shifting from reacting to leading, shaping, and disrupting the market. 

• DELIVER WITH EXCELLENCE: The emphasis is on delivering everything with excellence and pace, taking personal ownership, and holding each other accountable. We aim to shift from pride in thinking to pride in execution, developing breakthrough solutions and ensuring the best outcomes. 

“Our commitment to Equality, Diversity & Inclusion”

Unilever embraces diversity and encourages applicants from all walks of life! This means giving full and fair consideration to all applicants and continuing development of all employees regardless of age, disability, gender reassignment, race, religion or belief, sex, sexual orientation, marriage and civil partnership, and pregnancy and maternity.

Note: "All official offers from Unilever are issued only via our Applicant Tracking System (ATS). Offers from individuals or unofficial sources may be fraudulent—please verify before proceeding."