Senior Manager, Cyber Threat Exposure Management

Worker Type

Regular

Job Description

Summary

The Manager of Cyber Threat Exposure Management leads a small team responsible for identifying, validating, prioritizing, and driving remediation of cybersecurity exposures across the enterprise. This role manages the threat exposure life cycle across endpoints, servers, networks, cloud environments, applications, and identity systems.

This is a hands-on leadership position that combines personnel management, technical analysis, and coordination with IT and business stakeholders. The manager translates vulnerability findings, security configuration weaknesses, attack surface changes, and threat intelligence into actionable remediation priorities based on business impact and likelihood of exploitation.

Position Responsibilities

Team Leadership and Program Management

• Lead, mentor, and develop a team of 2–3 cybersecurity personnel, establishing clear responsibilities, priorities, and performance expectations.
• Manage daily operations, workload assignments, technical development, and quality of deliverables.
• Develop and maintain the threat exposure management strategy, roadmap, procedures, and operating cadence.
• Establish consistent processes for exposure discovery, validation, prioritization, remediation tracking, and closure verification.
• Manage supporting tools and service providers, identifying opportunities to improve coverage, efficiency, and automation.

Exposure Discovery and Assessment

• Oversee vulnerability scanning, asset discovery, external attack surface monitoring, and security configuration assessments.
• Identify gaps in asset inventory, scanning coverage, security tooling, and ownership that may leave exposures undetected or unresolved.
• Assess vulnerabilities, misconfigurations, excessive privileges, unsupported technologies, and exposed services across enterprise environments.
• Coordinate authorized security testing and attack path analysis to validate exposures and assess the effectiveness of existing safeguards.
• Incorporate findings from penetration tests, security assessments, threat intelligence, and incidents into the exposure management program.

Risk Prioritization and Remediation

• Prioritize exposures using exploitability, evidence of active exploitation, asset criticality, external accessibility, business impact, and compensating controls.
• Translate technical findings into clear remediation requirements for system owners, IT operations, engineering, and application teams.
• Establish risk-based remediation timelines and track findings through verified closure.
• Coordinate urgent assessment and remediation activities for actively exploited vulnerabilities and emerging threats.
• Escalate overdue or high-impact exposures and communicate remediation barriers to cybersecurity leadership.
• Manage exception documentation and review cycles, ensuring residual risks are routed to the appropriate authority for formal acceptance.

Cross-Functional Coordination

• Partner with security operations and incident response teams to connect exposure findings with detection opportunities, threat activity, and response priorities.
• Work with infrastructure, endpoint, identity, network, cloud, and application teams to address recurring weaknesses and improve secure configurations.
• Support governance, risk, and compliance teams with evidence of exposure identification, remediation, exceptions, and control effectiveness.
• Integrate exposure management requirements into technology onboarding, change management, and system lifecycle processes.

Metrics, Reporting, and Continuous Improvement

• Maintain dashboards and leadership reporting covering assessment coverage, critical exposures, remediation performance, aging findings, and exceptions.
• Measure verified risk reduction and recurring exposure trends to identify systemic issues.
• Automate scanning workflows, findings enrichment, ticket creation, ownership assignment, and remediation validation where practical.
• Provide clear recommendations to leadership on remediation priorities, resource constraints, and opportunities to strengthen security posture.

Basic Qualifications (Required Skills & Experience)

• Bachelor’s degree in cybersecurity, information technology, computer science, or a related field, or equivalent professional or military experience.
• Five or more years of cybersecurity experience, including substantial experience in vulnerability management, security engineering, or threat exposure management.
• Two or more years of team leadership, technical lead, or supervisory experience.
• Hands-on experience with enterprise vulnerability assessment platforms, security configuration tools, and remediation workflows.
• Working knowledge of Windows and Linux systems, enterprise networking, cloud services, identity security, and common attack techniques.
• Ability to assess vulnerabilities using technical severity, exploitability, threat intelligence, and business context.
• Experience coordinating remediation across multiple technical teams and communicating risk to technical and nontechnical stakeholders.
• Strong analytical, documentation, organizational, and personnel leadership skills.

Other Qualifications & Desired Competencies

• Experience with Microsoft Defender Vulnerability Management, Microsoft Defender for Endpoint, Microsoft Sentinel, Tanium, Tenable, Qualys, Rapid7, or comparable platforms.
• Experience with Microsoft Azure, Microsoft 365, hybrid environments, and GCC High.
• Familiarity with CMMC, NIST SP 800-171, NIST SP 800-53, and CIS Benchmarks.
• Experience supporting aerospace, defense, manufacturing, or other regulated environments.
• Experience with attack surface management, attack path analysis, or security control validation.
• Experience automating security workflows using PowerShell, Python, APIs, and enterprise ticketing platforms.
• Relevant cybersecurity certifications demonstrating technical or management proficiency.

Success Measures

• Accurate visibility into enterprise assets and exposure assessment coverage.
• Timely identification and prioritization of significant exposures.
• Improved remediation performance and reduced aging of high-risk findings.
• Verified closure of exposures and fewer recurring security weaknesses.
• Clear accountability for remediation ownership, escalation, and risk exceptions.
• Effective development and performance of the exposure management team.

Physical Demands

• Ability to work in an office environment (Constant)
• Required to sit and stand for long periods; talk, hear, and use hands and fingers to operate a computer and telephone keyboard (Frequent)

Clearance Level

Secret

The salary range for this role is:

$128,000 - $217,500

AeroVironment considers several factors when extending an offer, including but not limited to, the location, the role and associated responsibilities, a candidate’s work experience, education/training, and key skills.

ITAR Requirement:

This position requires access to information that is subject to compliance with the International Traffic Arms Regulations (“ITAR”) and/or the Export Administration Regulations (“EAR”). In order to comply with the requirements of the ITAR and/or the EAR, applicants must qualify as a U.S. person under the ITAR and the EAR, or a person to be approved for an export license by the governing agency whose technology comes under its jurisdiction. Please understand that any job offer that requires approval of an export license will be conditional on AeroVironment’s determination that it will be able to obtain an export license in a time frame consistent with AeroVironment’s business requirements. A “U.S. person” according to the ITAR definition is a U.S. citizen, U.S. lawful permanent resident (green card holder), or protected individual such as a refugee or asylee. See 22 CFR § 120.15. Some positions will require current U.S. Citizenship due to contract requirements.

Benefits: AV offers an excellent benefits package including medical, dental vision, 401K with company matching, a 9/80 work schedule and a paid holiday shutdown. For more information about our company benefit offerings please visit: http://www.avinc.com/myavbenefits.

We also encourage you to review our company website at http://www.avinc.com to learn more about us.

Principals only need apply. NO agencies please.

About AV:

AV isn’t for everyone. We hire the curious, the relentless, the mission-obsessed. The best of the best.

We don’t just build defense technology—we redefine what’s possible. As the premier autonomous systems company in the U.S., AV delivers breakthrough capabilities across air, land, sea, space, and cyber. From AI-powered drones and loitering munitions to integrated autonomy and space resilience, our technologies shape the future of warfare and protect those who serve.

Founded by legendary innovator Dr. Paul MacCready, AV has spent over 50 years pushing the boundaries of what unmanned systems can do. Our heritage includes seven platforms in the Smithsonian—but we’re not building history, we’re building what’s next.

If you're ready to build technology that matters—with speed, scale, and purpose—there’s no better place to do it than AV.

We are proud to be an EEO/AA Equal Opportunity Employer, including disability/veterans. AeroVironment, Inc. is an Equal Employment Opportunity (EEO) employer and welcomes all qualified applicants. Qualified applicants will receive fair and impartial consideration without regard to race, sex, color, religion, national origin, age, disability, protected veteran status, genetic data, sexual orientation, gender identity or other legally protected status.

ITAR

U.S. Citizenship required