Threat, Vulnerability & Exposure Management Architect - #2192873

Dev/Null Security is looking for an engineer turned architect to lead how clients identify and reduce exposure across their most important business services.

You will set the enterprise direction, secure agreement from directors and C-suite sponsors, and stay close enough to delivery to test whether a proposed design works. Success means teams change what they do and can show which risks they have reduced.

Experience you bring:

• You have owned an enterprise security strategy or target architecture and worked with delivery teams to put it into practice across business units.
• You have briefed directors and C-suite leaders on a significant exposure, explained the consequences in business terms and secured a decision on investment or risk.
• You can bring service owners, engineers and risk leaders together when they disagree on priorities, then agree who will act and by when.
• You understand threat and vulnerability management (TVM) and exposure management, from asset discovery to verifying that a fix protects a critical service.
• You have worked with assessment or prioritisation platforms. Experience with Tenable, Snyk, Kenna or comparable tools is valuable.
• You can interpret offensive security evidence, challenge a finding with a tester and explain what it does or does not prove.
• Application security (AppSec) and AI security knowledge is useful, particularly where vulnerable dependencies, sensitive data or agent permissions create paths to critical assets.

Architecture design and leadership:

• Translate business needs, threats and functional and non-functional requirements into practical architectures and clear trade-offs.
• Own target architectures, high-level designs, patterns and decisions; guide detailed design and assure implementation.
• Build transformation roadmaps with dependencies, delivery risks, acceptance criteria and operational handover.
• Present and defend designs at design authorities and executive forums; explain complex concepts clearly to different audiences.
• Provide thought leadership through technical challenge, emerging technology assessment and recommendations grounded in delivery experience.
• Influence stakeholders, facilitate workshops, build consensus and mentor engineers across security, technology and business teams.
• Apply peer review and governance; document deviations and risks, balancing security, resilience, user experience, cost and supportability.

Accountabilities and responsibilities:

Set the enterprise direction

• Map how applications, cloud, infrastructure and identities support critical services. Identify where assessment coverage or ownership breaks down.
• Define a target operating model with business and technology leaders: who owns exposure, who can accept residual risk and when decisions need escalation.
• Build a phased investment roadmap. Use threat intelligence, evidence of exploitation and business impact to decide what to address first.

Lead change with stakeholders

• Brief directors and C-suite sponsors on credible attack scenarios, options, cost and residual risk. Make the decision you need from them explicit.
• Facilitate workshops with product, operations and risk teams to resolve delivery constraints and agree remediation commitments.
• Equip service owners to adopt the changes. Track overdue decisions, recurring weaknesses and verified reductions in exposure with executive sponsors.

Direct offensive testing and interpret results

• Agree objectives and rules of engagement with offensive teams. Select automated penetration testing for repeatable checks and manual or red team exercises for scenarios that need human judgement.
• Analyse penetration test and red team reports with testers and defenders. Reconstruct the attack path, distinguish demonstrated access from assumptions, and identify which controls failed.
• Turn findings into specific design changes or fixes with named owners. Agree retest criteria and verify that the attack path has been closed.

Guide solution design and delivery

• Design how asset inventories, security findings and service ownership fit together. Specify how validated findings reach the engineering teams that can fix them.
• Review a pilot with engineers: check data quality, access controls and remediation workflows before agreeing acceptance criteria for wider rollout.

Qualifications and certifications:

Relevant degree or equivalent experience. CISSP, SABSA, TOGAF or relevant platform qualifications are desirable; practical delivery experience matters most.

Working at DevNull Security

Whilst DevNull Security is a remote-first company, our consulting team may be required to travel to client sites up to 3 times per week, depending on project and customer needs.

We believe that a career in cybersecurity should be accessible to everyone. We actively welcome applicants from all walks of life, regardless of race, ethnicity, gender identity, age, sexual orientation, disability, neurodiversity, socioeconomic background, or any other aspect of identity.

As a growing company, we’re committed to fostering an inclusive, equitable, and accessible hiring experience. We proactively offer adjustments during application and assessment - tell us what you need.