Senior Director, Exposure & Vulnerability Management

WTW is seeking a Senior Director of Exposure & Vulnerability Management to lead WTW's vulnerability management security program. Reporting to the Global Head of Attack Surface Management, this leader owns the strategy, execution and evolution of enterprise exposure management capabilities spanning vulnerability operations, exposure validation, aligning with secure development (SAST/SCA/DAST) and risk intelligence, with a relentless focus on prioritization, business impact, mitigation strategies and measurable risk reduction.

The role partners closely with Corporate & Business Technology, Cloud Operations, Product, Platform Engineering, Risk Management, Privacy & Compliance, Managed Service Providers and Internal Audit stakeholders to ensure security findings are translated into actionable insight, aligned remediation priorities and demonstrably improved security outcomes across the enterprise. As a senior member of the Attack Surface Management leadership team, the Senior Director also acts as a strategic deputy to the Global Head, contributing to program direction, investment decisions, steering committee deliverables, and executive-level reporting.

The Role

As WTW continues to scale its digital platforms, client services and cloud estate, managing cyber risk requires more than identifying vulnerabilities. It requires understanding exposure, exploitability, reachability and business impact across infrastructure, cloud, identity, applications and the software supply chain.

The Exposure & Vulnerability Management function is accountable for transforming how security risk is identified, contextualized, validated and addressed across the enterprise. This includes shifting to a unified, continuous exposure management model that is aligned to Continuous Threat Exposure Management (CTEM) principles and built on an accurate, authoritative view of WTW's assets. The Senior Director will lead multi-disciplinary global teams while driving modernization across data, tooling, metrics, governance and engagement models.

The ResponsibilitiesExposure Management Strategy & Program Leadership

• Define and own WTW's enterprise exposure & vulnerability management strategy and a multi-year roadmap that aligns infrastructure, cloud, application, identity and software supply chain risk into a unified risk view.

• Operationalize a continuous exposure & vulnerability management lifecycle (scoping, discovery, prioritization, validation and mobilization) aligned to CTEM principles.

• Track vulnerabilities via risk-based prioritization grounded in exploitability, threat intelligence, asset criticality, exposure and business impact.

• Establish clear ownership models, accountability and engagement patterns with technology and engineering teams to drive timely and effective remediation.