Lead Continous Threat Exposure Manager Gauteng

BRIEF DESCRIPTION:-

The Lead Continuous Threat Exposure Management Specialist is responsible for heading the development, administration, and enhancement of the company’s CTEM framework, delivering a risk-oriented perspective of cyber exposure across various business services and technologies. The role involves managing the full exposure management cycle, coordinating remediation efforts, and ensuring effective validation and executive reporting on risk mitigation. Essential skills include strategic leadership, risk management, and coordination during urgent cyber incidents, with relevant cybersecurity experience and certifications being highly desirable.

Job Title: Lead Continuous Threat Exposure Management Specialist Company: Optimal Growth Technologies

Description

Position Overview

Head the creation, administration and ongoing enhancement of the company’s Continuous Threat Exposure Management (CTEM) framework. This role is responsible for delivering a unified, risk-oriented perspective of cyber exposure across vital business services, infrastructure, telecommunications platforms, cloud settings, applications, APIs, identities, data, AI systems and approved third parties. The role will oversee the full exposure management cycle, encompassing discovery, prioritization, remediation, validation, exception handling, and executive reporting, with success gauged by verified risk mitigation rather than vulnerability counts.

Key Responsibilities

Develop and uphold the CTEM strategy, operating model, roadmap, governance framework, standards, and performance benchmarks. Implement continuous asset and exposure discovery, ensuring alignment with official inventories. Aggregate and correlate insights from various sources including vulnerability management, attack surface analysis, cloud security, identity and access management, application security testing, penetration testing, threat intelligence, incident response, audits, and control assurance. Rank exposures based on business criticality, customer impact, internet exposure, reachability, attack paths, privilege, known exploitation, threat intelligence, CVSS, CISA KEV, and EPSS, instead of technical severity alone. Manage a unified, governed exposure backlog with designated owners, actions, deadlines, interdependencies, exceptions, evidence, and audit trails. Coordinate remediation efforts across infrastructure, network, cloud, application, identity, supplier, business, and market teams. Lead urgent escalation and coordinated response for actively exploited vulnerabilities, credible zero-days, exposed privileged paths, and critical control failures. Conduct independent, evidence-based validation of remediation and reopen exposures where validation fails or evidence is insufficient. Manage time-bound risk acceptances, compensating controls, and escalation of overdue exposures, ownership gaps, and remediation obstacles. Deliver operational and executive reports on exposure coverage, critical attack paths, aging, remediation performance, exceptions, recurring issues, and verified risk reduction. Oversee exposure management tools, integrations, data quality, automation, and service provider performance. Transform recurring exposure themes into systemic control enhancements, architectural modifications, security testing, supplier actions, or problem-management initiatives. Ensure coverage of priority business services and critical technology assets. Reduce critical attack paths and known-exploited exposures. Achieve remediation performance targets. Minimize overdue, recurring, and reopened exposures. Increase the percentage of material exposures with accountable owners. Ensure the quality and timeliness of risk acceptances. Confirm successful independent validation of exposure closure. Demonstrate and sustain a reduction in residual cyber risk.

Experience and Qualifications

Essential Skills

Strategic leadership, risk-oriented business judgement, stakeholder engagement, executive communication, analytical decision-making, project management, proactive challenge, and coordination during urgent cyber exposure incidents.

Required Education and Experience

Relevant degree or equivalent experience in cybersecurity, technology, engineering, or risk management. Considerable experience leading vulnerability management, exposure management, cyber-risk reduction, security testing, or a related enterprise security capability. Strong expertise in infrastructure, cloud, identity, application, API, network, and telecommunications security. Proven ability to coordinate remediation across complex technology and business environments. Comprehensive understanding of attack-path analysis, threat-informed prioritization, security assurance, and exception governance. Experience in managing executive reporting, governance forums, senior stakeholders, and service providers. Relevant certification such as CISSP, CISM, CRISC, CCSP, OSCP, or GIAC is advantageous. Knowledge of NIST CSF 2.0, MITRE ATT&CK, CISA KEV, and FIRST EPSS is advantageous.