Senior Manager, External Attack Surface Management

Global Risk and Security (GR&S) at Vanguard enables business strategy, protects client and Vanguard interests (e.g., assets and data), and stewards a strong risk culture. Our teams leverage enterprise-wide insights, deep expertise, and trusted advice so that across Vanguard leaders and crew drive faster, stronger, risk-informed decisions.

Within GR&S, the Enterprise Security and Fraud (ES&F) sub-division is responsible for the global protection of Vanguard crew, property, data, and client assets. We are the trusted advisors that protect the pride of Vanguard with state-of-the-art security and fraud capabilities. We are a world-class destination of highly engaged, passionate, and diverse talent expected to continuously learn and develop in an ever-changing security landscape. Our crew are our greatest resource – by joining our team you will build collaborative long-term relationships and enjoy a suite of benefits that includes comprehensive health and wellness care, work-life balance, and an investment in your future at its core.

Vanguard is seeking a highly skilled and experienced Senior Manager of External Attack Surface Management to join our Global Enterprise Security team. This role will be pivotal in overseeing and enhancing the security posture of our SaaS environments by implementing a comprehensive Security SaaS Posture Management (SSPM) tool, driving attack surface reduction initiatives, and managing our responsible disclosure program. The ideal candidate will possess a deep understanding of external threat landscapes and will play a critical role in safeguarding Vanguard’s digital assets and infrastructure.

Duties and Responsibilities

• SaaS Security Management: Lead the implementation and management of a Security SaaS Posture Management (SSPM) tool to monitor and secure Vanguard’s SaaS applications.
• Attack Surface Reduction: Develop and execute strategies to continuously reduce Vanguard’s external attack surface. Collaborate with cross-functional teams to identify, assess, and mitigate risks.
• Responsible Disclosure Program: Oversee the establishment and operation of a responsible disclosure program, ensuring that vulnerabilities are identified, reported, and remediated in a timely manner.
• Team Leadership: Build and lead a high-performing team focused on external attack surface management. Provide mentorship, coaching, and professional development to team members.
• Stakeholder Collaboration: Work closely with internal stakeholders, including IT, legal, compliance, and external partners, to align security strategies with business objectives.
• Threat Intelligence Integration: Leverage threat intelligence to proactively identify and mitigate potential threats and vulnerabilities.
• Metrics and Reporting: Develop key performance indicators (KPIs) and metrics to measure the effectiveness of attack surface management initiatives. Provide regular reports to senior leadership on the status and impact of security efforts.

Required Qualifications

• Bachelor’s degree in computer science, Information Security, or a related field.
• 12+ years of experience in cybersecurity, with a focus on attack surface management, SaaS security, or similar roles.
• Proven experience in implementing and managing SSPM tools and other security technologies.
• Strong understanding of SaaS architectures, cloud security principles, and external threat landscapes.
• Experience in developing and managing responsible disclosure or vulnerability management programs.
• Excellent leadership and team management skills, with a track record of building and leading high-performing teams.
• Strong analytical and problem-solving skills, with the ability to assess and mitigate complex security risks.
• Excellent communication and collaboration skills, with the ability to influence stakeholders at all levels.
• CISSP required or must commit to obtaining CISSP within one year of hire.

Preferred Qualifications

• Master’s degree in information security, Cybersecurity, or a related field.
• Relevant certifications such as CRISC, CISM, CCSP, or equivalent.
• Experience working in a large, complex enterprise environment, preferably within the financial services industry.
• Knowledge of regulatory and compliance requirements related to information security (e.g., GDPR, ISO 27001, NIST).
• Familiarity with emerging security technologies and trends, particularly in SaaS and cloud security.

Special Factors

Sponsorship

About Vanguard

At Vanguard, we don't just have a mission—we're on a mission.

To work for the long-term financial wellbeing of our clients. To lead through product and services that transform our clients' lives. To learn and develop our skills as individuals and as a team. From Malvern to Melbourne, our mission drives us forward and inspires us to be our best.

Our commitment to diversity, equity, and inclusion

Vanguard’s commitment to diversity, equity, and inclusion (DEI) is central to our ability to deliver on our mission. We aspire to create a work environment that is inclusive, equitable, and diverse—one that enables our employees, whom we call crew, to thrive and bring their best selves to work every day on behalf of our clients.

Cultivating DEI lifts our entire organization, and everyone shares accountability for our progress—from our senior leaders who lay the foundation and set the example for inclusive behaviors to crew who are growing in their personal DEI learning experiences.

Together, we’re on a mission. We are fueled by the value of diverse voices and connected through friendships and a culture of care—for our clients, our communities, and each other.    

Vanguard’s DEI journey has no finish line. Our commitment is enduring, and we remain focused on the path ahead. To learn more about Vanguard goals and progress toward DEI, download our Diversity, Equity, and Inclusion Report.

How We Work

Vanguard has implemented a hybrid working model for the majority of our crew members, designed to capture the benefits of enhanced flexibility while enabling in-person learning, collaboration, and connection. We believe our mission-driven and highly collaborative culture is a critical enabler to support long-term client outcomes and enrich the employee experience.