Senior Manager, Threat and Vulnerability Management

About the role

AirAsia Aviation Management Services is looking for a Senior Manager of Threat and Vulnerability Management in Sepang, Selangor. The role leads the end-to-end vulnerability management program, penetration testing, red teaming, threat intelligence and threat hunting, and acts as the main security partner for system owners, developers, infrastructure teams and vendors.

Key responsibilities

• Own and evolve the continuous vulnerability management program across multi-cloud, modern and legacy environments, defining risk-based prioritization based on CVSS severity, asset criticality and exploitability.
• Work with ICT, SRE and business units to enforce remediation timelines and patching accountability, and set metrics, SLAs and executive dashboards.
• Define the strategy and schedule for penetration testing and red teaming, manage internal specialists and external vendors, and oversee post-assessment remediation validation.
• Build a Cyber Threat Intelligence program using MITRE ATT&CK, run threat hunting campaigns across endpoints, identity and cloud, and feed findings back into detection tools and prioritization engines.
• Lead a team of vulnerability analysts, penetration testers and threat researchers, give hands-on technical guidance and foster a culture of technical rigor.
• Negotiate remediation priorities with senior leaders and evaluate, implement and optimize TVM and offensive security tooling.

Required profile

• 10+ years of experience in cybersecurity, focused on vulnerability management, penetration testing, threat intelligence and red teaming.
• Bachelor's degree in Computer Science, Information Security or a related technical field.
• Proven ability to lead teams, build relationships and influence decisions at all levels.
• Excellent communication skills, able to turn complex attack vectors into business insights.
• Certifications such as OSCP, GXPN, GPEN, CISSP or CISM are highly advantageous.

Required skills

• Deep understanding of exploit mechanisms, CVSS and EPSS risk scoring, cloud security and network architecture.
• Knowledge of security tooling and offensive security toolkits.