Manager, Exposure Management

ROLE SUMMARY

Our Global Cyber Defense team is responsible for safeguarding Pfizer’s digital assets and infrastructure through proactive threat detection, response, and risk mitigation across on-premises, cloud, and hybrid environments.

The Manager, Exposure Management is an individual contributor remediation lead role responsible for coordinating and driving the remediation of cybersecurity exposures across the organization, ensuring identified security risks are effectively prioritized, assigned, tracked, escalated, and resolved. The role supports the end-to-end remediation lifecycle for a broad range of security exposures, including vulnerabilities, security misconfigurations, control gaps, offensive security findings, and other identified security risks.

This role serves as a key liaison between cybersecurity teams and US business, application, infrastructure, and technology owners, translating security findings into actionable remediation plans and driving accountability for timely risk reduction. The Exposure Management lead applies risk-based prioritization, facilitates cross-functional remediation efforts, identifies and removes barriers to resolution, and escalates significant or overdue risks to appropriate leadership.

The role also provides remediation governance, metrics, and executive-level reporting, helping leadership understand remediation performance, significant exposures, exceptions, recurring challenges, and areas requiring intervention. Through strong stakeholder engagement and cross-functional leadership, the Exposure Management lead helps ensure that cybersecurity risks are addressed consistently and driven through validated closure and measurable risk reduction.

ROLE RESPONSIBILITIES

• Lead the end-to-end remediation lifecycle for security exposures, including assignment, remediation planning, progress tracking, escalation, validation, and closure of vulnerabilities and other security findings.
• Coordinate with US business, application, infrastructure, and technology owners to establish clear accountability, actionable remediation plans, target dates, and sustained progress toward risk reduction.
• Apply risk-based prioritization using technical severity, exploitability, threat context, asset criticality, business impact, and compensating controls to focus remediation efforts on the most significant exposures.
• Provide remediation governance and oversight, ensuring consistent management of remediation commitments, exceptions, risk decisions, overdue findings, dependencies, and validation of closure.
• Lead cross-functional remediation efforts across cybersecurity, technology, application, infrastructure, and business teams to resolve dependencies, remove barriers, and drive security risks to timely resolution.
• Identify and escalate high-risk, overdue, or blocked remediation activities to appropriate cybersecurity, technology, and business leadership, clearly communicating risk, business impact, barriers, and decisions required.
• Develop and communicate remediation metrics, trends, and executive-level reporting to provide visibility into remediation performance, significant risks, exceptions, recurring issues, and areas requiring leadership attention.
• Partner with vulnerability management, threat intelligence, offensive security, incident response, and other cybersecurity teams to translate vulnerabilities and broader security findings into prioritized remediation actions and measurable risk reduction.

BASIC QUALIFICATIONS

• Bachelor’s degree in Computer Science, Information Security, Engineering, or related technical discipline, or equivalent experience.

• 4+ years of experience in cybersecurity, with demonstrated experience in vulnerability management, exposure management, security risk management, remediation, security operations, or a related cybersecurity discipline.
• Demonstrated experience with remediation governance, including coordinating security findings through assignment, remediation planning, progress tracking, exception management, escalation, validation, and closure.
• Experience applying risk-based prioritization to vulnerabilities and other security findings using factors such as technical severity, exploitability, threat context, asset criticality, business impact, and compensating controls.
• Demonstrated experience coordinating with business, application, infrastructure, and technology owners to translate identified security risks into actionable remediation plans and drive issues to timely resolution.
• Strong cross-functional leadership and stakeholder-management skills, with experience working across cybersecurity, technology, application, and business teams where remediation requires coordination across multiple owners or organizations.
• Experience identifying remediation barriers, dependencies, and overdue risks and facilitating resolution or escalating issues to the appropriate technology, business, or cybersecurity leadership.
• Demonstrated ability to develop and communicate remediation status, risk, trends, and key issues to leadership, including concise executive-level reporting and escalation of high-risk or time-sensitive exposures.
• Strong understanding of vulnerability and security risk management principles, including vulnerability assessment, remediation, compensating controls, risk acceptance, and validation of remediation.
• Strong analytical and problem-solving skills, with the ability to evaluate security findings in their technical and business context and help stakeholders determine appropriate remediation priorities and risk-reduction actions.
• Excellent written and verbal communication skills, with the ability to communicate technical security risks, remediation requirements, and decision points effectively to both technical and non-technical stakeholders.

• Demonstrated ability to work in an agile work environment possessing qualities such as a collaborative mindset, adaptability to change, and a proactive problem-solving approach.

PREFERRED QUALIFICATIONS

• Experience supporting or leading enterprise-scale vulnerability, exposure, or security remediation programs within a complex global organization.
• Experience operating cybersecurity programs within a regulated or highly controlled environment, preferably healthcare, life sciences, pharmaceutical, or manufacturing.
• Demonstrated experience applying threat intelligence, exploitability, asset criticality, business impact, and compensating controls to inform risk-based remediation priorities and risk-treatment decisions.
• Experience developing remediation metrics, risk reporting, and executive communications that clearly communicate significant exposures, remediation progress, exceptions, overdue risks, and issues requiring leadership intervention.
• Relevant cybersecurity certifications such as CISSP or SANS/GIAC certifications related to vulnerability assessment, penetration testing, incident response, or security operations, such as GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), or GIAC Penetration Tester (GPEN), or comparable industry credentials.

Please apply by sending your CV in English.

Work Location Assignment: Hybrid



The annual base salary for this position ranges from €31.125,00. This salary range applies to the location Greece-Thessaloniki Chortiatis. We also offer a range of benefits and programs to meet colleagues’ needs. Benefits vary by location and can include health care coverage, retirement savings plans, insurance benefits, an Employee Assistance Program, wellness benefits and more. Additional details about total compensation and benefits will be provided during the hiring process. Pfizer compensation structures and benefit packages are aligned based on the location of hire. Final compensation will be determined based on the successful candidate’s relevant skills, experience, and qualifications, in accordance with pay equity principles and applicable employment laws.


Pfizer endeavors to make www.pfizer.com/careers accessible to all users. If you would like to contact us regarding the accessibility of our website or need assistance completing the application process and/or interviewing, please email [email protected]. This is to be used solely for accommodation requests with respect to the accessibility of our website, online application process and/or interviewing. Requests for any other reason will not be returned.



To learn more about acceptable and prohibited uses of AI during the recruitment process, please review our candidate AI-use guidelines available on Pfizer Careers.

Information & Business Tech