Senior Director, Vulnerability Management

THE ROLE We are seeking a Senior Director to lead our Defect Management (Vulnerability Management) and Penetration Testing teams, which span penetration testing, vulnerability management, bug bounty program management, and defect remediation.
Reporting to the Vice President, Governance, Risk and Compliance (GRC) and Operations, you will lead a multi-disciplinary team and partner with cross-functional teams across regions to ensure vulnerabilities are prioritized, remediated, and monitored to protect Live Nation Entertainment's assets and data.
You will clearly communicate the business impact and urgency of security defects while following the defined risk management process, and you will define the outcomes and metrics for Defect Management across the enterprise.
This is a delivery-focused leadership role: you own program plans, roadmap commitments, and remediation service-level agreements (SLAs), and you are accountable for measurable, on-time reductions in enterprise vulnerability exposure.
WHAT THIS ROLE WILL DO Build and lead a high-performing, multi-disciplinary security team across multiple locations Set the team's strategic direction and development, lead by example, and mentor team members at all levels Research and communicate emerging security threats relevant to the environments we operate Participate in threat modeling, security design reviews, penetration testing, and remediation verification Partner with application teams enterprise-wide to detect, prioritize, and remediate security defects throughout the SDLC, embedding a security mindset from concept through implementation, including hands-on security training for architects and developers Set clear priorities and deadlines and hold the team accountable for timely, high-quality delivery Own budget, headcount planning, and resource allocation for both teams, including tooling, third-party testing, vendor, and bug bounty spend Lead response to zero-day vulnerabilities and urgent exploits: coordinate with Cyber Security Operations, Threat Intelligence, and internal/external business partners, communicate clearly and promptly to leadership and stakeholders, and track each issue to closure.
Requires 24/7 availability for urgent matters Partner with Cyber Security Operations and Threat Intelligence on red and purple team exercises to validate detection and response and prioritize remediation of exploitable paths Program Management build project plans with milestones, risks, and deadlines; escalate blockers early and deliver on time Drive measurable reduction in vulnerability exposure, including Known Exploited Vulnerabilities (KEV) and aged backlog, and remediate all Critical vulnerabilities within regulatory timeframes (ex. PCI DSS) Establish and enforce risk-based remediation SLAs, exception and risk-acceptance criteria, compensating controls, and escalation paths; track exceptions to closure Own scanning and assessment coverage across on-premises, cloud, container, application, and API environments, including authenticated coverage and discovery of unmanaged, shadow, and end-of-life assets Lead the bug bounty program end-to-end, from submission through triage, assignment, remediation, retesting, and closure, with SLA and aging reporting at every stage Lead security testing of AI-enabled products, including LLM-based and agentic applications, incorporating AI-specific threats (e.g., OWASP Top 10 for LLM Applications) into testing methodologies Drive automation and AI-enabled integrations across CMDB, ITSM, scanning, and bug bounty platforms to automate ownership mapping, ticket routing, SLA tracking, and reporting Select, implement, and continuously evaluate security testing tooling (coverage, cost, overlap), including continuous and agentic penetration-testing platforms; own the penetration-testing and scanning infrastructure; and make evidence-based retain/discontinue recommendations with transition plans Align the program to PCI DSS, CIS Controls, SOC 1/SOC 2, CCPA, NIS2, and other applicable requirements; maintain audit evidence and support audits, assessments, and security reviews Establish processes to assign, track, and remediate findings from external security-rating and third-party risk services Business Stakeholder Management document failures, pursue service credits, and report on vendor effectiveness WHAT THIS PERSON WILL BRING Knowledge of Cyber Security standards and regulations, including PCI DSS, CIS Controls, SOC 2, CCPA, and NIS2, and of desktop, server, application, database, and network security principles; experience maintaining audit evidence Experience performing penetration testing and exploitation against applications, APIs, web, mobile, and modern infrastructure (containers, microservices, serverless) in cloud (AWS, Azure) and on-premises environments Track record of building and managing large, diverse teams: attracting, hiring, developing, and retaining top security talent and giving them the vi