Senior Manager – Threat & Vulnerability Management (Cybersecurity)

About the role

PwC is seeking a Senior Manager to lead its Threat and Vulnerability Management (TVM) practice. You will work with a team of problem‑solvers to identify, assess and mitigate security risks for a range of clients, driving both strategic advice and hands‑on technical execution.

Key responsibilities

• Conduct security assessments, red‑team exercises, web‑application penetration testing, vulnerability assessments and secure‑configuration reviews.
• Advise clients on relevant regulations and standards such as NIS2, ISO 27001 and NIST.
• Help grow the TVM team and expand service offerings.
• Support the implementation of advanced red‑team infrastructure.
• Identify and evaluate emerging security technologies, tools and methods.
• Stay current on the latest threats and compliance requirements related to penetration testing.

Required profile

• Strong experience in offensive security and red‑team operations.
• Proven leadership in managing diverse technical teams, mentoring and talent development.
• Experience developing payloads and evading modern EDR solutions.
• Significant background implementing red‑team infrastructure and conducting regular vulnerability scans.
• Hands‑on expertise with network, database, Windows and Linux security reviews.
• Experience with red‑team tools such as Cobalt Strike, NightHawk and Mythic.
• Extensive web and mobile application penetration‑testing experience.
• Familiarity with security assessment platforms (Burp Suite, Tenable Nessus, Qualys, Rapid7).
• Knowledge of attacker methodologies and mitigation strategies.
• Intermediate cloud penetration‑testing and secure‑configuration skills.
• Additional experience in ransomware‑simulation scripting or security architecture design is a plus.
• Relevant technical security certifications (e.g., OSCP, CRTO, OSEP, OSWE) are advantageous.

Required skills

• Offensive security
• Red‑team operations
• Payload development
• EDR evasion
• Red‑team infrastructure
• Vulnerability assessment
• Penetration testing
• Secure configuration review
• Cobalt Strike
• NightHawk
• Mythic
• Web application testing
• Mobile application testing
• Burp Suite
• Tenable Nessus
• Qualys
• Rapid7
• Attacker methodology knowledge
• Cloud penetration testing
• Ransomware simulation scripting
• Security architecture design
• NIS2, ISO 27001, NIST standards