Senior Director, Vulnerability Management & Penetration Testing

THE ROLE

We are seeking a Senior Director to lead our Defect Management (Vulnerability Management) and Penetration Testing teams, which span penetration testing, vulnerability management, bug bounty program management, and defect remediation.

Reporting to the Vice President, Governance, Risk and Compliance (GRC) and Operations, you will lead a multi-disciplinary team and partner with cross-functional teams across regions to ensure vulnerabilities are prioritized, remediated, and monitored to protect Live Nation Entertainment’s assets and data. You will clearly communicate the business impact and urgency of security defects while following the defined risk management process, and you will define the outcomes and metrics for Defect Management across the enterprise.

This is a delivery-focused leadership role: you own program plans, roadmap commitments, and remediation service-level agreements (SLAs), and you are accountable for measurable, on-time reductions in enterprise vulnerability exposure.

WHAT THIS ROLE WILL DO

• Build and lead a high-performing, multi-disciplinary security team across multiple locations
• Set the team’s strategic direction and development, lead by example, and mentor team members at all levels
• Research and communicate emerging security threats relevant to the environments we operate
• Participate in threat modeling, security design reviews, penetration testing, and remediation verification
• Partner with application teams enterprise-wide to detect, prioritize, and remediate security defects throughout the SDLC, embedding a security mindset from concept through implementation, including hands-on security training for architects and developers
• Set clear priorities and deadlines and hold the team accountable for timely, high-quality delivery
• Own budget, headcount planning, and resource allocation for both teams, including tooling, third-party testing, vendor, and bug bounty spend
• Lead response to zero-day vulnerabilities and urgent exploits: coordinate with Cyber Security Operations, Threat Intelligence, and internal/external business partners, communicate clearly and promptly to leadership and stakeholders, and track each issue to closure. Requires 24/7 availability for urgent matters
• Partner with Cyber Security Operations and Threat Intelligence on red and purple team exercises to validate detection and response and prioritize remediation of exploitable paths

Program Management & Delivery

• Own program goals and roadmap commitments; build project plans with milestones, risks, and deadlines; escalate blockers early and deliver on time
• Drive measurable reduction in vulnerability exposure, including Known Exploited Vulnerabilities (KEV) and aged backlog, and remediate all Critical vulnerabilities within regulatory timeframes (ex. PCI DSS)
• Establish and enforce risk-based remediation SLAs, exception and risk-acceptance criteria, compensating controls, and escalation paths; track exceptions to closure
• Own scanning and assessment coverage across on-premises, cloud, container, application, and API environments, including authenticated coverage and discovery of unmanaged, shadow, and end-of-life assets
• Lead the bug bounty program end-to-end, from submission through triage, assignment, remediation, retesting, and closure, with SLA and aging reporting at every stage
• Lead security testing of AI-enabled products, including LLM-based and agentic applications, incorporating AI-specific threats (e.g., OWASP Top 10 for LLM Applications) into testing methodologies
• Drive automation and AI-enabled integrations across CMDB, ITSM, scanning, and bug bounty platforms to automate ownership mapping, ticket routing, SLA tracking, and reporting
• Select, implement, and continuously evaluate security testing tooling (coverage, cost, overlap), including continuous and agentic penetration-testing platforms; own the penetration-testing and scanning infrastructure; and make evidence-based retain/discontinue recommendations with transition plans
• Align the program to PCI DSS, CIS Controls, SOC 1/SOC 2, CCPA, NIS2, and other applicable requirements; maintain audit evidence and support audits, assessments, and security reviews
• Establish processes to assign, track, and remediate findings from external security-rating and third-party risk services

Business Stakeholder Management & Executive Reporting

• Build trust and collaboration across business and technology stakeholders with competing priorities through regular, transparent, data-driven communication, and track stakeholder commitments to completion
• Lead recurring stakeholder reviews of goals, progress, and blockers, ensuring decisions and actions are documented and followed through
• Produce executive-ready metrics (coverage, SLA attainment, risk burn-down, exceptions, business impact) and present program status and risks to senior leadership

External Partner & Vendor Management

• Manage third-party vendors and PCI ASV/QSA engagements, including scoping, quality review, and remediation tracking
• Hold vendors accountable to contractual SLAs; document failures, pursue service credits, and report on vendor effectiveness

WHAT THIS PERSON WILL BRING

• Knowledge of Cyber Security standards and regulations, including PCI DSS, CIS Controls, SOC 2, CCPA, and NIS2, and of desktop, server, application, database, and network security principles; experience maintaining audit evidence
• Experience performing penetration testing and exploitation against applications, APIs, web, mobile, and modern infrastructure (containers, microservices, serverless) in cloud (AWS, Azure) and on-premises environments
• Track record of building and managing large, diverse teams: attracting, hiring, developing, and retaining top security talent and giving them the vision, support, and culture to deliver impact
• High ethical standards and discretion with confidential information
• Technical knowledge of adversary Tactics, Techniques, and Procedures (TTPs)
• Understanding of common software security issues and remediation techniques (CISA KEV, OWASP Top 10, SANS 25, MITRE, etc.)
• Deep knowledge of the threat landscape and emerging security strategies and products
• Strong program management discipline: builds project plans with milestones, risks, and deadlines, communicates status proactively, and delivers on time
• Attention to detail and a sense of urgency in prioritizing and responding to time-sensitive security issues
• Experience operating a bug bounty or vulnerability disclosure program and managing security vendors, third-party penetration-testing firms, SLAs, and reporting
• Experience managing remediation against compliance-driven SLAs, including PCI DSS requirements, and governing exceptions and risk acceptance

Desirable

• 10+ years in technical security roles, including penetration testing or security hardening
• 5+ years driving cyber security initiatives across large, diverse organizations
• Experience working in global environments spanning multiple time zones
• Training in Cyber Security-specific disciplines
• Advanced written and verbal communication skills with technical and non-technical audiences, including senior leadership
• Relevant industry certifications (e.g., OSCP, OSCE, GPEN, GWAPT, CISSP, CISM)

BENEFITS & PERKS

Our motto is ‘Taking Care of Our Own’ through 6 pillars of benefits:

• HEALTH: Medical, vision, dental and mental health benefits for you and your family, with access to a health care concierge, and Flexible or Health Savings Accounts (FSA or HSA)
• YOURSELF: Free concert tickets, generous paid time off including paid holidays, sick time, and personal days
• WEALTH: 401(k) program with company match, stock reimbursement program
• FAMILY: New parent programs including caregiver leave and baby bonuses, plus fertility, adoption, foster, or surrogacy support
• CAREER: Career and skill development programs with School of Live, tuition reimbursement, and student loan repayment
• OTHERS: Volunteer time off, crowdfunding match