Technical Security Governance Lead - Exposure Management

Why we're hiring:

We are looking for a Technical Security Governance Lead – Exposure Management to help build, mature, and govern a modern exposure management capability across our global environment.

This role focuses on understanding how attackers see us—across external, internal, and AI-enabled environments—and ensuring the organization continuously validates, prioritizes, and reduces real-world attack opportunities.

This is a highly strategic, lead-level role for someone who understands modern attack paths and wants to shape how security is measured and improved. You will move beyond theoretical risk into practical attacker realism—governing the adversarial testing programs, attack surface visibility, exploitability validation, and attack path analysis that keep WPP secure.

What you'll be doing:

Technical Security & Exposure Governance

• Define and shape the governance framework, guardrails, and minimum standards for continuous exposure management across WPP.
• Drive continuous improvement in attack surface visibility, control effectiveness, and risk-driven exposure governance.
• Establish escalation thresholds for validated exploitable paths and constructively challenge delayed remediations.

Adversarial Assurance Governance

• Oversee and govern continuous adversarial testing and offensive validation programs across infrastructure, applications, APIs, cloud, and identity.
• Partner with and govern specialist external providers to validate real-world exploitability and attack paths.
• Help internal teams understand where technical weaknesses translate into realistic attack opportunities.

AI Adversarial Testing Governance

• Shape and govern the adversarial testing approaches for AI and agentic systems, a rapidly growing and critical domain for WPP.
• Support and oversee testing for modern AI risks, including prompt injection resilience, tool misuse, data leakage scenarios, and agent permission boundaries.
• Collaborate with product and AI teams to mature security controls and drive safer AI adoption.

Attack Surface & Path Analysis

• • Maintain strategic visibility of WPP’s external-facing assets, governing unknown asset discovery, internet exposure drift, and shadow IT.
  • Map and analyze complex attack paths across identity boundaries, privilege escalation routes, lateral movement pathways, and cloud trust relationships.
  • Identify and escalate systemic exposure patterns to prevent recurring vulnerabilities.

What you'll need:

Experience & Qualifications:

• 5+ years of experience in offensive security, exposure management, red teaming, or attack surface management.
• Strong technical understanding of attacker tradecraft, adversarial testing methodologies, and modern attack techniques (e.g., EASM, BAS, Attack Path Analysis).
• Proven experience analyzing attack paths within cloud- and identity-based environments.
• Interest or experience in AI security and emerging AI attack models.
• Education & Certifications: Bachelor’s degree in Information Security, Computer Science, or a related field (or equivalent practical experience). Industry certifications such as OSCP, CREST, or CISSP are highly regarded.

Personal Attributes:

• Strategic & Impact-Focused: Ability to align technical security exposure with broader business risks and goals.
• Collaborative Leader: Strong relationship-building skills to work effectively with diverse, global teams and influence remediation without direct authority.
• Proactive & Accountable: A self-starter with a strong sense of ownership, comfortable navigating a fast-paced, dynamic environment.

Who you are: