Technical Security Governance Lead - Exposure Management

WPP is the trusted growth partner for the world’s leading brands. 

We unite cutting-edge media intelligence and data solutions, world-class creativity, next-generation production, transformative enterprise solutions and expert strategic counsel in a single company – powered by exceptional talent and our agentic marketing platform, WPP Open, to help our clients navigate change, capture opportunity and deliver transformational growth. 

We work with the world's most valuable brands and have global reach across 100+ markets, with deep local expertise.

Our people are the key to our success. We're committed to fostering a culture of creativity, belonging and continuous learning, attracting and developing the brightest talent, and providing exciting career opportunities that help our people grow. 

For more information, visit WPP.com.

We are looking for a lead for Exposure Management to provide deep technical investigation of suspected security exposures across WPP's global technology estate.

Working within TSG, this role will investigate vulnerabilities and attack opportunities across a highly diverse environment spanning cloud, infrastructure, operating systems, identity, applications, AI and emerging technologies. You will use modern security, exposure and adversarial-testing capabilities to understand whether weaknesses are genuinely exploitable, how they could combine into realistic attack paths, and which exposure deserves attention first.

This is a hands-on technical role with enterprise-wide reach. You will investigate complex security questions, challenge assumptions with evidence, identify systemic patterns, and translate technical findings into clear priorities for the teams responsible for remediation. You will not own every fix. Your role is to establish technical reality, determine what matters, and direct attention towards the improvements that will most meaningfully reduce WPP's exposure.

The role sits within Technical Security Governance (TSG), reporting to the Director, Security Governance & Posture within the Group CISO organisation.

• Act as WPP’s technical Principal for Exposure Management, providing senior technical judgement on attack paths and systemic exposure across the global technology environment.
• Investigate suspected vulnerabilities across infrastructure, operating systems, identity, cloud, applications, data and AI.
• Follow the evidence beyond the tool output, combining information from multiple sources to determine what is genuinely exploitable, how weaknesses connect, and what actually matters.
• Assess attack paths and systemic exposure, maintaining enough perspective to distinguish significant enterprise risk from isolated or technically interesting findings.
• Establish technical priorities for mitigation, helping teams focus effort on the exposures most likely to materially improve WPP's security posture.
• Work with TSG specialists across Cloud, Identity, Data, Infrastructure, Application and AI to understand findings in context and develop technically credible recommendations for system owners.
• Provide broad technical security expertise on complex security questions, technologies and protective approaches, including areas such as encryption, security tooling and emerging threats.
• Support major security events where rapid technical investigation, exposure analysis and remediation prioritisation are required.
• Continuously improve how WPP understands exposure, identifying recurring patterns, challenging assumptions and helping us get better at finding the problems that actually matter.

Essential:

• 5+ years of hands-on technical security experience, with meaningful practical experience investigating, defending or validating real enterprise technology.
• Strong foundations across enterprise technology, such as networks, infrastructure, operating systems, identity, cloud, applications or security operations, with enough breadth to understand how weaknesses interact across domains.
• Practical attacker and defender knowledge, with the ability to reason about vulnerabilities, exploitability, attack paths, defensive controls and realistic attack opportunities.
• Strong investigative and critical-thinking skills, including the curiosity to challenge assumptions, question tool output and follow evidence until the underlying technical reality is understood.
• The judgement to prioritise, knowing when to investigate deeply, when enough is known to act, and when an interesting technical issue is not the most important problem.
• Professional English, sufficient to investigate, collaborate and communicate effectively across WPP's global technology and security organisation.
• Ability to work primarily from WPP's São Paulo office as part of the wider security team.

Desirable:

• Practical experience in one or more of Red Team, Blue Team, Purple Team, Vulnerability Management, Exposure Management, Security Engineering, Security Research, Vulnerability Research, adversarial validation or attack-path analysis.
• Experience translating complex technical findings into clear priorities and recommendations that other technology teams can act on.
• Experience working across multiple technology domains rather than remaining exclusively within a single technical specialism.
• Experience operating with substantial autonomy, creating structure from ambiguity and maintaining perspective across competing technical problems.
• Experience influencing technical outcomes through expertise, evidence and collaboration, rather than relying on direct authority.
• Strong communication skills with the ability to work equally well with deep technical specialists and senior stakeholders.
• 10+ years of broader IT or cybersecurity experience, ideally including earlier hands-on experience with enterprise infrastructure, networks, operating systems, applications or security operations.
• Experience with enterprise vulnerability, attack-surface, exposure, BAS or security-posture platforms, particularly where multiple sources must be correlated to understand the real picture.
• Experience investigating exposure across cloud, identity, applications, AI or agentic systems.
• Experience supporting major incidents, urgent remediation programmes or complex technical investigations under time pressure.
• Experience designing or improving technical security methodologies, processes, metrics or prioritisation approaches.
• Relevant technical education or certifications. Practical experience and demonstrated technical judgement matter more than certification volume.

Please submit your CV in English.

We believe the best work happens when we're together, fostering creativity, collaboration, and connection. That's why we’ve adopted a hybrid approach, with teams in the office around four days a week. If you require accommodations or flexibility, please discuss this with the hiring team during the interview process.

WPP is an equal opportunity employer and considers applicants for all positions without discrimination or regard to particular characteristics. We are committed to fostering a culture of respect in which everyone feels they belong and has the same opportunities to progress in their careers.

Please read our Privacy Notice (https://www.wpp.com/en/careers/wpp-privacy-policy-for-recruitment) for more information on how we process the information you provide.