Director, Technical Vulnerability Management & Remediation Orchestration

Job Description:
About us:
News Corp is a global, diversified media and information services company focused on creating and distributing authoritative and engaging content and other products and services. The company comprises businesses across a range of media, including: information services and news, digital real estate services and book publishing. Headquartered in New York, News Corp operates primarily in the United States, Australia and the United Kingdom, and its content and other products and services are distributed and consumed worldwide.
Job Title: Director, Technical Vulnerability Management & Remediation Orchestration
Reporting to: SVP, Infrastructure & Enterprise Technology
Location: NYC
Type: Hybrid 3 days a week in office
Pay Range: $190,000 - $220,000 + Bonus
Position Overview
The Director of Technical Vulnerability Management (VM) & Remediation Orchestration is the global operational leader responsible for defining, driving, and scaling News Corp’s enterprise vulnerability remediation strategy. Reporting directly to the SVP, Infrastructure & Enterprise Technology, you will lead the central Vulnerability Remediation Services function, serving as the connective operational bridge between Enterprise Cyber Security, Technology Operations / Service Management, Infrastructure, and Business Unit (BU) leadership—including platform owners across Dow Jones, HarperCollins, Realtor.com, News Corp Australia, News UK, New York Post, News Corp HQ, and Global Technology.
In this role, you will strategically partner with Cyber Security (owners of core VM scanning tools and policy) and Tech Ops / Service Delivery (owners of the CMDB and asset topology) to ingest and leverage up-to-date, normalized risk data enabling presentation to platform owners.
Your core mandate is to leverage and mature existing reporting and ticket orchestration, driving remediation and compliance through defined Continuous Threat Exposure Management (CTEM) frameworks, ensure SLA compliance, and facilitate cadence-based reporting with Global Tech and business partners.
Key Responsibilities
Strategic Leadership, Governance and Cross-Functional Partnerships
Establish and execute a unified, global vulnerability remediation management strategy spanning cloud (AWS, Azure, GCP), infrastructure, applications, containerized workloads, and edge systems, leveraging Continuous Threat Exposure Management (CTEM) principles to systematically scope, discover, prioritize, validate, and mobilize remediation.
Define and maintain enterprise-wide VM remediation processes, and associated SLAs tailored to asset criticality and business context.
Partner with BU executives, engineering heads, and IT directors to align VM remediation policies and findings against operational constraints and product roadmaps.
Act as primary operational partner with defined BU VM Champions and technical leads, providing actionable insights and highlighting bottlenecks in meeting remediation SLAs
Partner with Cyber Security leads to continuously evaluate scanning coverage (SAST/DAST/SCA, CSPM, EASM) to ensure vulnerability detection feeds align with evolving threat models, policy requirements, and vendor consolidation strategy to maximize ROI.
Remediation Orchestration & Enterprise Coordination
Establish and govern standardized global vulnerability remediation workflows, patch windows, maintenance schedules and remediation cadences across all critical infrastructure and application tiers, driving consistent accountability across global BUs.
Establish and maintain an enterprise Responsibility Matrix (RACI) clearly defining ownership and handoffs between centralized vulnerability management, cyber security functions, shared infrastructure services and BU-managed platforms.
Partner with BU engineering and operations leadership to define, document and operationalize localized patch regimens and asset lifecycle management plans, including roadmaps for legacy End-of-Life (EOL) and Out-of-Service-Life technologies.
Design, implement and maintain automated remediation workflows in Jira /ServiceNow, translating normalized findings from defined scanning tools into clear, prioritized actionable items assigned to system and application owners.
Lead global cross-BU governance meetings and vulnerability steering committees to track outstanding issues, resolve resource bottlenecks and drive continuous alignment.
Establish formal risk-acceptance and escalation governance pathways for unresolved risks, aged vulnerabilities, and exceptions, presenting structured risk-acceptance profiles and formal exposure reviews to executive leadership and risk committees.
Scanning Operations, Visibility, and Proactive Platform Vulnerability Monitoring
Partner with the Cyber Security function to ensure appropriate tooling is in place for the evaluation, implementation, and management of modern vulnerability identification tools (DAST, SAST, SCA, CSPM, EASM).
Shift from reactive patching to risk-based vulnerability management (RBVM) and exposure validation, utilizing threat intelligence, exploitability data (EPSS, KEV), and business impact to prioritize remediation efforts across high-value asset environments.
Coordinate with platform owners to monitor vendor security advisories, CVEs, product updates and EOL notifications alongside Cyber Security scanning, ensuring emerging threats and vulnerabilities are assessed, owned and remediated appropriately.
Coordinate vendor architectural reviews with platform owners to identify security misconfigurations, architectural weaknesses and design vulnerabilities, ensuring findings are risk assessed, prioritised and remediated.
Automation & Proactivity
Drive the use of automation and AI across VM, improving asset identification, CMDB accuracy, scanning, remediation and reporting.
In partnership with Cyber Security, evaluate, consolidate, and rationalize vendor security tooling and platforms across BUs to reduce operational complexity, ensure architectural consistency, and maximize return on security investments (ROI).
Lead root-cause analysis of recurring systemic vulnerabilities, championing DevSecOps principles and embedding automated security gates and shift-left controls within CI/CD pipelines to prevent security regressions early in the development lifecycle.
Metrics, Reporting & Continuous Improvement
Define and monitor VM KPIs and KRIs, delivering measurable 6–12 month performance improvements—including a target reduction in Mean Time to Remediate (MTTR) for critical/high vulnerabilities and achieving 90%+ SLA compliance across all business units.
Develop global and BU VM risk dashboards and executive reporting for the CISO, CTO, Risk Committee and Board, highlighting key vulnerabilities, trends, remediation progress and residual risk.
Qualifications & Leadership Profile
Experience: 10+ years in Information Technology with heavy involvement across Security, IT Risk or Cybersecurity operations, including 5+ years in a global leadership or Director-level role managing enterprise vulnerability programs.
Domain Expertise: Deep expertise in enterprise VM, remediation orchestration, patch management, risk-based prioritisation and vulnerability detection across complex IT and cloud environments.