Associate Director, Threat Exposure Management

Location: Bengaluru
Department: Security

The Associate Director, Threat Exposure Management will lead a defined area of the Threat Exposure Management capability and the team or programme that delivers it.

This role will provide the opportunity to lead key activities to progress your career.

Responsibilities:

• Lead a defined area of the capability, including its people, delivery and outcomes.
• Manage delivery against the capability roadmap and escalate blockers early.
• Develop team capability through coaching, review and structured feedback.
• Represent the area in CSO governance and cross-functional forums.
• Maintain a continuous view of GSK's threat exposure across vulnerabilities, external attack surface, configuration drift and control coverage.
• Prioritise exposure using exploitability, asset criticality and business impact rather than raw severity scores.
• Operate exposure and vulnerability tooling, including coverage assurance and data quality.
• Track remediation against agreed service levels and escalate where it slips.
• Manage the exception and risk acceptance process with documented residual risk.

Requirements:

• Degree in a relevant discipline, or related experience.
• Demonstrated experience in vulnerability or exposure management.
• Working knowledge of risk-based prioritisation of technical findings.
• Practical experience with operational reporting and process improvement.
• Significant experience in cyber security within the relevant domain.
• Proven experience leading a team or a substantial programme of work.
• Experience managing delivery to plan, quality and timelines.
• Excellent relationship management, influencing and communication skills.

Preferred Qualifications:

• Experience with continuous threat exposure management practice.
• Experience with enterprise vulnerability and attack surface tooling.
• Familiarity with EPSS and the CISA Known Exploited Vulnerabilities catalogue.
• Data visualization skill in Power BI.
• Relevant certification such as CISSP, CompTIA Security+, GIAC, CRISC.
• Experience in pharmaceutical, life sciences or another highly regulated industry.

Typical tools and technologies: Qualys, Tenable, Rapid7, external attack surface management tooling, CSPM, ServiceNow, Power BI.