Technology Director

Wells Fargo is seeking a Technology Director to lead vulnerability management and application security capabilities within Wealth and Investment Management Technology (WIMT). This senior technology leadership role will be responsible for advancing a proactive, scalable, and risk-based approach to identifying, prioritizing, remediating, and preventing technology vulnerabilities across applications, infrastructure, cloud, container, open-source, and hybrid technology environments.

This leader will provide strategic direction for the vulnerability management function and work across Technology, Cybersecurity, Risk, Audit, Product, Engineering, and other key stakeholders to strengthen governance, accountability, engineering practices, and measurable risk reduction.

The Technology Director will lead a federated operating model that combines centralized vulnerability-management leadership with accountability across technology and product organizations. The role will also drive increased adoption of secure software development, DevSecOps, automation, authoritative vulnerability data, reusable remediation approaches, and responsible use of AI to improve vulnerability-management effectiveness and efficiency.

Success in this role will be measured by the organization’s ability to reduce vulnerability exposure, prioritize remediation based on risk, prevent recurring vulnerabilities, strengthen ownership and accountability, validate remediation, and increase the scalability and effectiveness of vulnerability-management practices.

In this role, you will

• •Set and execute the strategic direction for vulnerability management and application security across WIMT, evolving the function toward proactive risk reduction, prevention, engineering enablement, and measurable outcomes
• •Serve as a senior change agent across WIMT, driving transparency, accountability, consistent execution, and sustainable improvement across CIO and technology organizations
• •Lead a federated, risk-based operating model across applications, infrastructure, data center, cloud, containers, platforms, open-source software, and other technology environments, with clear governance, decision rights, ownership, and escalation
• •Establish a transparent and authoritative view of vulnerability exposure and remediation performance, giving technology and executive leaders actionable insight into risk, ownership, aging, dependencies, commitments, systemic issues, and areas requiring intervention
• •Represent WIMT in shaping enterprise vulnerability-management and application-security capabilities, influencing enterprise strategy, tooling, data, processes, and roadmaps while driving appropriate WIMT capabilities where gaps exist
• •Shift vulnerability management toward an engineering-enablement model, providing teams with actionable data, automation, self-service capabilities, reusable remediation patterns, standards, and preventative controls that reduce friction and accelerate risk reduction
• •Provide strategic leadership for Application Security and secure software delivery, including secure SDLC, DevSecOps, SAST, DAST, SCA, penetration testing, threat modeling, software supply-chain risk, and earlier integration of security into engineering practices
• •Drive risk-based prioritization, remediation, validation, root-cause analysis, and risk decisions using exploitability, business impact, asset and application criticality, production exposure, threat intelligence, and control effectiveness
• •Partner and influence across senior Technology, Cybersecurity, Risk, Audit, Product, Engineering, and Infrastructure leadership to address material vulnerabilities, systemic risks, control issues, dependencies, and remediation commitments
• •Drive continuous improvement through automation, AI, authoritative data, simplified processes, reusable solutions, and talent development, reducing manual work and recurring vulnerabilities while increasing the scalability and effectiveness of vulnerability management

Required Qualifications

• •10+ years of Technology Strategic Leadership experience, or equivalent demonstrated through one or a combination of the following: work experience, training, military experience, education
• •4+ years of management or leadership experience
• •5+ years of Experience leading a large-scale vulnerability management, Application Security, cyber risk, security engineering, or closely related technology function
• •5+ years of Experience with Application Security, secure software development lifecycle practices, DevSecOps, and risk-based vulnerability prioritization and remediation
• •5+ years of Experience leading significant technology or cybersecurity transformation, including changes to operating models, accountability, processes, engineering practices, data, or technology capabilities
• •5+ years of experience leading horizontally through influence in a complex matrixed organization and driving outcomes across organizations outside of direct reporting lines
• •5+ years of Experience partnering with and influencing senior Technology, Cybersecurity, Risk, Audit, Product, Engineering, Infrastructure, and business stakeholders
• •5+ years of Experience translating technology and business requirements into broader enterprise capabilities, technology strategies, platforms, or operating-model improvements
• •5+ years of Experience establishing transparent management reporting, authoritative data, meaningful metrics, and executive-level risk views that enable decisions, accountability, and measurable outcomes
• •5+ years of Experience developing technology talent, building organizational capabilities, and communicating complex technology and cybersecurity risks to senior leadership

Desired Qualifications

• •Experience leading vulnerability management or Application Security within a large, complex, highly regulated financial services organization
• •Advanced knowledge of secure SDLC, secure-by-design principles, DevSecOps, threat modeling, SAST, DAST, SCA, penetration testing, software supply-chain security, and modern application architectures.
• •Experience establishing federated vulnerability-management, security-champion, or similar technology-risk and engineering-enablement models
• •Experience implementing threat-informed and business-contextual vulnerability prioritization and translating technical findings into meaningful business and technology risk
• •Experience developing executive vulnerability reporting that connects exposure with applications, criticality, ownership, remediation commitments, aging, dependencies, and systemic risk.
• •Experience establishing authoritative vulnerability data and consolidating fragmented reporting, tooling, governance, and manual operational processes
• •Experience developing automated or self-service capabilities supporting vulnerability remediation, validation, evidence collection, prioritization, reporting, and reusable remediation patterns
• •Experience influencing enterprise cybersecurity, technology, or engineering capabilities and roadmaps and applying automation or AI to improve cybersecurity, secure development, or engineering productivity
• •Demonstrated ability to challenge established processes, remove organizational friction, influence senior stakeholders, and lead sustained change across organizational boundaries

Job Expectations

• •Provide strategic leadership for vulnerability management and Application Security across a complex technology organization
• •Operate as a change leader, not solely a control or governance leader, continuously identifying opportunities to simplify, automate, enable, and strengthen how vulnerability risk is managed
• •Create transparency across WIMT so leaders and accountable technology owners have a consistent, trusted, and actionable understanding of vulnerability exposure, ownership, remediation commitments, systemic risks, and areas requiring intervention
• •Maintain a risk-based appr