About the role
The Info Security Ops Group Manager is a senior management level position responsible for providing strategic leadership, operational oversight, and people management for application security testing services. This role ensures the delivery of high-quality Application Vulnerability Assessment and Management (AVA/AVM) services while maintaining operational excellence, service continuity, and adherence to cybersecurity standards.
The position plays a critical role in defining and executing the organization's perimeter testing strategy, helping protect critical business applications from emerging cyber threats. As a people leader, the Manager develops and leads a team of cybersecurity professionals, drives continuous service improvement, and partners with senior stakeholders to enhance the firm's overall security posture.
Key Responsibilities
Strategic Leadership
* Define and execute the long-term strategy and roadmap for Application Vulnerability Management services. * Lead the evolution of perimeter testing capabilities to address emerging threats and business requirements. * Partner with senior cybersecurity leaders, technology organizations, and business stakeholders to align security testing initiatives with enterprise risk management objectives. * Drive innovation, automation, and process improvements to enhance service effectiveness and efficiency.
Service Delivery & Operations
* Oversee day-to-day AVA/AVM pentest operations, ensuring consistent delivery of high-quality vulnerability assessment services. * Maintain service continuity, operational resilience, and compliance with established service level expectations. * Establish and monitor key performance indicators, quality metrics, and reporting to measure program effectiveness. * Ensure timely identification, assessment, prioritization, and remediation tracking of application vulnerabilities.
Team Leadership & Development
* Lead, mentor, and develop a team of cybersecurity specialists responsible for application security testing and vulnerability management activities. * Foster a culture of accountability, collaboration, innovation, and continuous learning. * Support workforce planning, talent development, succession planning, and employee engagement initiatives. * Provide technical guidance and strategic direction to ensure consistent execution across the team.
Risk Management & Governance
* Ensure AVA/AVM services operate in alignment with organizational cybersecurity policies, standards, and regulatory requirements. * Identify and manage security, operational, and compliance risks associated with application security testing activities. * Communicate risk insights and remediation priorities to senior management and key stakeholders. * Support internal and external audit activities and demonstrate effective security governance practices.
Stakeholder Engagement
* Build strong relationships with technology, engineering, application development, and cybersecurity teams. * Act as the primary management representative for AVA/AVM services. * Present program performance, risk trends, and strategic initiatives to senior leadership.
Qualifications
* 10+ years of extensive experience in application security, vulnerability assessment, vulnerability management, penetration testing, or related cybersecurity domains. * Demonstrated experience leading cybersecurity teams and managing large-scale security operations. * Strong understanding of application security testing methodologies, vulnerability management practices, and secure software development principles. * Experience managing stakeholder relationships across technology and business organizations. * Excellent leadership, communication, and organizational skills. * Experience building and executing enterprise-scale application security programs. * Knowledge of cloud security, DevSecOps practices, and modern application architectures. * Experience driving cybersecurity transformation and service modernization initiatives.
Education:
* Bachelor’s degree/University degree or equivalent experience * Holding relevant professional cybersecurity certifications such as CISSP, CISM, GWAPT, GPEN, OSCP, or equivalent.
------------------------------------------------------
Job Family Group:
Technology
------------------------------------------------------
Job Family:
Information Security
------------------------------------------------------
Time Type:
Full time
------------------------------------------------------
Most Relevant Skills
Please see the requirements listed above.
------------------------------------------------------
Other Relevant Skills
For complementary skills, please see above and/or contact the recruiter.
------------------------------------------------------
Citi is an equal opportunity employer, and qualified candidates will receive consideration without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other characteristic protected by law.
If you are a person with a disability and need a reasonable accommodation to use our search tools and/or apply for a career opportunity review Accessibility at Citi.
View Citi’s EEO Policy Statement and the Know Your Rights poster.