Senior Manager, Threat and Vulnerability Management

Job Description WHAT YOU'LL DO: Vulnerability Assessment & Management Own and evolve the end-to-end continuous vulnerability management program across multi-cloud, modern infrastructure, and legacy environments. Define risk-based prioritization logic combining vulnerability severity (CVSS), asset criticality, and active exploitability metrics. Collaborate closely with ICT, SRE, and business unit stakeholders to enforce remediation timelines and drive patching accountability without disrupting business operations.

Establish metrics, SLAs, and executive dashboards to communicate enterprise exposure and remediation progress to senior leadership. Penetration Testing & Red Teaming Define the operational strategy and schedule for penetration testing and objective-based red teaming exercises. Manage internal specialists and external vendors/penetration testers to ensure comprehensive coverage, clear scope definition, and high-quality deliverables.

Oversee post-assessment remediation validation to ensure identified security gaps are properly addressed. Threat Intelligence & Threat Hunting Build and integrate a Cyber Threat Intelligence (CTI) program to gather, analyze, and act upon emerging threat indicators and adversary TTPs (MITRE ATT&CK framework). Direct proactive threat hunting campaigns across endpoints, identity, and cloud environments to uncover hidden, undetected adversaries or security weaknesses.

Feed threat intelligence and hunting findings back into detection tools, threat models, and vulnerability prioritization engines. Stakeholder Management & Strategic Leadership Serve as the primary security partner and strategic interface for system owners, software developers, infrastructure teams, and third-party vendors. Influence and negotiate remediation priorities with senior business and technical leaders, balancing cyber risk reduction against operational impact.

Evaluate, implement, and optimize TVM and offensive security technology stacks (scanners, pentesting toolkits, threat intel feeds). Team Leadership and Development Build, mentor, and lead a high-performing team of vulnerability management analysts, penetration testers, and threat researchers. Provide hands-on technical guidance during complex technical deep-dives, exploit evaluations, and attack surface reviews.

Foster a culture of technical rigor, continuous learning, and innovation within the offensive and proactive security domains. WHO YOU ARE: 10+ years of experience in Cyber Security, with a strong focus on Vulnerability Management, Penetration Testing, Threat Intelligence, and Red Teaming. Technically apt with deep understanding of exploit mechanisms, risk scoring frameworks (CVSS, EPSS), cloud security, network architecture, and security tooling Proven ability to lead and motivate teams, build strong relationships, and influence decision-making at all levels.

Bachelor's degree in Computer Science, Information Security, or a related technical field. Excellent communication skills, capable of translating complex attack vectors and security risks into actionable business insights. Relevant industry certifications (e.g., OSCP, GXPN, GPEN, CISSP, CISM, or equivalent) are highly advantageous. We are all different - one talent to another - that is how we rely on our differences.

At AirAsia, you will be treated fairly and given all chances to be your best.We are committed to creating a diverse work environment and are proud to be an equal opportunity employer. Search Firm Representatives - AirAsia does not accept unsolicited assistance from search firms for employment opportunities. All CVs / resumes submitted by search firms to any employee at our company without a valid written search agreement in place will be deemed the sole property of our company.

No fee will be paid in the event a candidate is hired by our company as a result of an agency referral where no pre-existing agreement is in place.