below marketmost similar roles pay hereabove market
This role pays less than
62%
of similar roles. Most pay
$161,250–$222,800
— the blue band above.
At the midpoint, this role pays about
$169k
versus about
$192k
for comparable roles.
Based on 240 similar postings.
Employer
About State Street
State Street Corporation is one of the world''s largest custodian banks and asset managers, providing investment servicing, investment management, and investment research to institutional investors. Industry: Financial Services & Asset Custody
State Street currently has
351 open roles
on FindRole.
Listed pay typically runs
$115,000–$195,944
across 199 roles with salary data.
The Head of Threat & Vulnerability Operations is a senior leadership role responsible for transforming the firm's threat and vulnerability capability into a modern, product-led, data-driven operations platform. You will lead a multidisciplinary team including product management, compliance, and data analytics to consolidate disparate discovery signals—such as infrastructure scanning, static and dynamic code analysis, and frontier-AI model scanning—into one authoritative exposure picture. Your daily work involves owning the findings lifecycle, including validation, threat-informed prioritization, and machine-speed escalation. You will build end-to-end architecture to accelerate attack-surface reduction while ensuring provable assurance for regulators. Key competencies include vulnerability scoring, risk-prioritization models, and managing remediation SLAs across federated engineering and infrastructure teams to address complex security risks in a large, regulated environment.
Drive the modernization of the threat and vulnerability capability into a scalable, product-led operations platform.
Consolidate all discovery signals into a single backlog with a unified severity language and SLA clock.
Own the vulnerability scoring model and Key Risk Indicators (KRIs) to reflect threat-informed, outcome-based metrics.
Manage the end-to-end findings lifecycle, including tracking, routing, and escalation for remediation by engineering teams.
Establish a "Reporting-as-a-Service" model to provide standardized, self-service reporting for executives, auditors, and regulators.
Build and lead a multidisciplinary team including product management, compliance, and data analytics functions.
Serve as the primary point of accountability for exposure data quality, regulatory commitments, and executive briefings.
What we're looking for
Bachelor's degree in Computer Science, Information Security, Engineering, or a related field.
Advanced degree (preferred).
Relevant certifications such as CISSP, CISM, or cloud security (preferred).
10+ years of progressive experience in cybersecurity, specifically in threat and vulnerability management, security operations, or cyber risk leadership.
Demonstrated success leading digital transformation or large-scale operational modernization of automated, data-driven platforms.
Proven experience designing and scaling enterprise vulnerability programs and consolidating disparate signal sources into a single reconciled exposure picture.
Hands-on experience with vulnerability scoring, risk-prioritization models, and evolving KRIs from control-presence to outcome-based measures.
Experience leading global, multidisciplinary security operations teams including product management, compliance, and data analytics functions.