Senior Director, Vulnerability Management – Penetration Testing

Live Nation Entertainment

. Lead Defect Management/Vulnerability Management and Penetration Testing teams spanning penetration testing, vulnerability management, bug bounty management, and defect remediation .

Posted 11/12/2026full-timeUnited StatesSenior💰 $174,000 - $218,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in leading vulnerability management, penetration testing, and security teams while ensuring compliance with standards such as PCI DSS and CIS Controls. Proven ability to manage complex security programs, mentor diverse teams, and communicate effectively with stakeholders at all levels.

Highest-signal resume keywords

Vulnerability ManagementPenetration TestingPCI DSS ComplianceTeam LeadershipSecurity Standards Knowledge

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Penetration TestingVulnerability ManagementSecurity AuditingThreat ModelingRisk AssessmentSecurity Design ReviewsBug Bounty ManagementRemediation TechniquesCloud Security (AWS, Azure)Application Security

Soft Skills

Communication SkillsTeam BuildingAttention to DetailMentoringStakeholder Collaboration

Tools & Technologies

Security Testing ToolsPenetration Testing PlatformsCMDBITSMBug Bounty Platforms

Certifications & Qualifications

OSCPOSCEGPENGWAPTCISSPCISM

Industry Keywords

Cyber Security StandardsCIS ControlsSOC 2CCPANIS2OWASP Top 10SANS 25MITREAdversary TacticsCompliance-Driven SLAs

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityITSMMicroservicesSDLC

About the role

Key responsibilities & impact

Lead Defect Management/Vulnerability Management and Penetration Testing teams spanning penetration testing, vulnerability management, bug bounty management, and defect remediation
Report to the Vice President, Governance, Risk and Compliance (GRC) and Operations
Build and lead a high-performing, multi-disciplinary security team across multiple locations
Set strategic direction, develop the team, lead by example, and mentor team members
Research and communicate emerging security threats
Participate in threat modeling, security design reviews, penetration testing, and remediation verification
Partner with application teams across the enterprise to detect, prioritize, and remediate security defects throughout the SDLC
Provide hands-on security training for architects and developers
Set priorities and deadlines and ensure timely, high-quality delivery
Own budget, headcount planning, resource allocation, tooling, third-party testing, vendor, and bug bounty spend
Lead response to zero-day vulnerabilities and urgent exploits, coordinating with security operations, threat intelligence, and business partners
Track urgent issues to closure and communicate status to leadership and stakeholders
Partner on red and purple team exercises to validate detection and response
Own program goals, roadmap commitments, project plans, milestones, risks, and deadlines
Drive measurable reductions in vulnerability exposure, including KEV and aged backlog
Remediate Critical vulnerabilities within regulatory timeframes such as PCI DSS
Establish risk-based remediation SLAs, exception and risk-acceptance criteria, compensating controls, and escalation paths
Own scanning and assessment coverage across on-premises, cloud, container, application, and API environments
Discover unmanaged, shadow, and end-of-life assets
Lead the bug bounty program from submission through triage, assignment, remediation, retesting, and closure
Lead security testing of AI-enabled products, including LLM-based and agentic applications
Incorporate AI-specific threats such as the OWASP Top 10 for LLM Applications into testing methodologies
Drive automation and AI-enabled integrations across CMDB, ITSM, scanning, and bug bounty platforms
Select, implement, and evaluate security testing tooling and penetration-testing platforms
Own penetration-testing and scanning infrastructure and make retain/discontinue recommendations
Align the program to PCI DSS, CIS Controls, SOC 1/SOC 2, CCPA, NIS2, and other applicable requirements
Maintain audit evidence and support audits, assessments, and security reviews
Establish processes to track and remediate findings from external security-rating and third-party risk services
Build stakeholder collaboration through transparent, data-driven communication
Lead recurring stakeholder reviews and track commitments to completion
Produce executive-ready metrics and present program status and risks to senior leadership
Manage third-party vendors and PCI ASV/QSA engagements
Hold vendors accountable to contractual SLAs, document failures, pursue service credits, and report vendor effectiveness

Requirements

What you’ll need

Knowledge of cyber security standards and regulations, including PCI DSS, CIS Controls, SOC 2, CCPA, and NIS2
Knowledge of desktop, server, application, database, and network security principles
Experience maintaining audit evidence
Experience performing penetration testing and exploitation against applications, APIs, web, mobile, containers, microservices, serverless, cloud (AWS, Azure), and on-premises environments
Track record of building and managing large, diverse teams, including attracting, hiring, developing, and retaining security talent
High ethical standards and discretion with confidential information
Technical knowledge of adversary Tactics, Techniques, and Procedures (TTPs)
Understanding of common software security issues and remediation techniques, including CISA KEV, OWASP Top 10, SANS 25, and MITRE
Deep knowledge of the threat landscape and emerging security strategies and products
Strong program management discipline, including project plans, milestones, risks, deadlines, proactive status communication, and on-time delivery
Attention to detail and urgency in prioritizing and responding to time-sensitive security issues
Experience operating a bug bounty or vulnerability disclosure program
Experience managing security vendors, third-party penetration-testing firms, SLAs, and reporting
Experience managing remediation against compliance-driven SLAs, including PCI DSS requirements
Experience governing exceptions and risk acceptance
10+ years in technical security roles, including penetration testing or security hardening (desirable)
5+ years driving cyber security initiatives across large, diverse organizations (desirable)
Experience working in global environments spanning multiple time zones (desirable)
Training in cyber security-specific disciplines (desirable)
Advanced written and verbal communication skills with technical and non-technical audiences, including senior leadership (desirable)
Relevant industry certifications such as OSCP, OSCE, GPEN, GWAPT, CISSP, or CISM (desirable)
Requires 24/7 availability for urgent matters

Benefits

Comp & perks

Medical, vision, dental and mental health benefits for you and your family
Health care concierge
Flexible Spending Accounts (FSA) or Health Savings Accounts (HSA)
Free concert tickets
Generous paid time off including paid holidays, sick time, and personal days
401(k) program with company match
Stock reimbursement program
New parent programs including caregiver leave and baby bonuses
Fertility, adoption, foster, or surrogacy support
Career and skill development programs with School of Live
Tuition reimbursement
Student loan repayment
Volunteer time off
Crowdfunding match
Flexible or hybrid/remote work arrangements indicated by the listed location tags