Director of Vulnerability and Exploits

THE POSITION: NMC² is seeking a Director of Vulnerability and Exploits to lead one of the most technically demanding functions in the security organization. Reporting to the VP of Security Operations, this leader owns the identification, analysis, and remediation of vulnerabilities across NMC²’s infrastructure, paired with an exploit research capability that keeps the company ahead of the threat landscape rather than reacting to it. This is not a scan-and-ticket function, and we are not looking for someone to run a tool and file findings. We are looking for a research-minded technical leader who will build a program that genuinely understands how vulnerabilities and exploits impact production: what actually puts the platform at risk, how to measure that risk credibly, and how to prioritize maintenance against real exploitability and operational impact rather than raw severity scores. You will drive original research into NMC²’s own attack surface, reverse-engineer exploits to understand what defenders are truly facing, and develop new methods for risk measurement and remediation prioritization that improve on the industry-standard playbook. You will build and run a team across two disciplines, vulnerability management and exploit research, setting technical direction and standards for both. You will own the full vulnerability lifecycle while directing a research effort that stress-tests NMC²’s most critical systems and feeds hard evidence back into how the platform is defended and maintained. The ideal candidate is a technical leader with deep hands‑on expertise in vulnerability research and exploit analysis who has made the transition into building and developing high‑performing teams. You understand the unique attack surfaces of HPC and AI-scale infrastructure, you bring a data‑driven and inventive approach to risk, and you are as comfortable briefing the VP of Security Operations on program health as you are working a novel exploit chain alongside your team.

RESPONSIBILITIES: Lead and grow a team of vulnerability and exploit specialists across both vulnerability management and exploit research, establishing clear ownership, technical standards, research direction, and development paths. Own the end‑to‑end vulnerability management program across NMC²’s full infrastructure footprint: asset coverage, continuous assessment, triage, risk‑based prioritization, remediation tracking, and SLA enforcement. Direct an exploit research function that goes beyond cataloging CVEs: reverse‑engineer exploits and proof‑of‑concept code to understand true exploitability, build PoCs against NMC²’s own systems, and model adversarial scenarios relevant to HPC and AI environments. Innovate how the program measures risk. Move beyond raw CVSS to context‑aware models that account for exploitability (EPSS, KEV, weaponization signals), reachability, blast radius, and impact to production workloads, and validate those models against real findings. Develop new approaches to prioritizing maintenance and remediation, framing patch and mitigation decisions around demonstrated exploitability and operational impact so engineering teams spend effort where it measurably reduces risk. Build the research capability to understand vulnerability and exploit impact to production: how a given class of flaw behaves in NMC²’s specific stack, what compensating controls actually hold, and where standard guidance does not fit a bare‑metal HPC environment. Partner closely with Infrastructure, Platform Engineering, and Network teams to drive effective remediation and embed secure‑by‑default practices, giving engineers clear, well‑contextualized, and actionable guidance. Drive tooling strategy and investment for the function, evaluating and deploying vulnerability assessment, management, and exploit research platforms appropriate to NMC²’s scale, with a bias toward depth and customization over off‑the‑shelf reporting. Develop and maintain program metrics, dashboards, and reporting cadences that give the VP of Security Operations clear visibility into exposure, remediation velocity, exploitability‑weighted risk, and program maturity. Stay ahead of the evolving vulnerability and exploit landscape, particularly across GPU clusters, HPC interconnects, firmware and BMC/DRAC, AI workloads, and the CI/CD and supply chain, and fold emerging threats into research and program priorities. Collaborate with the Threat Intelligence, Incident Response, and Offensive Security teams so that vulnerability and exploit findings inform detection, response, and adversary modeling across the security organization. Represent the Vulnerability and Exploits function in cross‑functional security reviews, risk forums, and leadership briefings, communicating program status and risk posture with clarity and precision.

REQUIREMENTS: 8+ years of experience in vulnerability research, offensive security, or exploit development, with at least 3 years in a people management or team leadership role. Deep, hands‑on technical expertise in vulnerability analysis and exploit research: reverse engineering, proof‑of‑concept development, and understanding root cause and exploitability rather than consuming scanner output. Strong command of vulnerability management at scale, including enterprise assessment platforms, CVSS and EPSS, KEV, and risk‑based prioritization methodologies, with the judgment to know where those standards fall short and improve on them. Demonstrated ability to innovate: developing new risk‑measurement models, prioritization frameworks, or research methods, not just operating an existing program. Experience securing large‑scale infrastructure environments; familiarity with the vulnerability landscape of HPC, GPU clusters, high‑speed interconnects, firmware, or AI workloads is a strong advantage. Proven ability to build and lead high‑performing technical teams, including hiring, mentoring, and developing practitioners across a range of seniority levels. Strong cross‑functional collaboration skills, with a track record of working with infrastructure and engineering teams to drive remediation outcomes and embed secure‑by‑default practices. Experience defining and operating program metrics, SLAs, and executive reporting, with the ability to communicate risk posture clearly to technical and non‑technical stakeholders. Familiarity with vulnerability disclosure standards, the CVE process, and coordinated disclosure practices, and the ability to navigate them responsibly. Analytical, structured, and inventive, able to run a broad program across many asset classes while retaining the technical depth to engage meaningfully with complex exploit research. Bachelor’s degree in Engineering, Computer Science, or a related field, or equivalent experience. It is impossible to list every requirement for, or responsibility of, any position. Similarly, we cannot identify all the skills a position may require since job responsibilities and the Company’s needs may change over time. Therefore, the above job description is not comprehensive or exhaustive. The Company reserves the right to adjust, add to or eliminate any aspect of the above description. The Company also retains the right to require all employees to undertake additional or different job responsibilities when necessary to meet business needs. Must be legally authorized to work in the United States without the need for employer sponsorship, now or at any time in the future. Company-Paid Lunch Stipend : Lunch is provided via GrubHubCompany-Paid Benefits:100% Employer-Paid Medical in our High Deductible Health Plan, Dental and Vision benefits for employees and their families, 16 weeks of Paid Parental Leave, Employee Assistance Program, Life insurance, Short-Term Disability and Long-Term Disability 401(k):Company will match 100% of your contributions up to 6%Optional Employee-Paid Benefits: Medical insurance in our PPO plan and a variety of other benefits such as Health Savings Accounts (with Company Contribution!), Flexible Spending Accounts, Supplemental Life Insurance, Wellhub and more. Time Off:25 days of Paid Time Off plus 12 company holidaysEQUAL OPPORTUNITY EMPLOYER