Enterprise Penetration Testing Program & Risk-Based Vulnerability Management

Penetration testing existed before I took this on, but it was ad hoc — engagements happened inconsistently, and findings didn't always translate into fixed vulnerabilities. I built a formal program covering the full breadth of the business: corporate systems, retail store environments, and warehouse/distribution operations, each with very different risk profiles and constraints.

I owned the program end to end — scoping and coordinating engagements, overseeing execution, and, critically, driving remediation in partnership with the application and infrastructure teams that owned the affected systems. That's where most pentest programs fall down: findings pile up without ever getting fixed. I made remediation follow-through a first-class part of the process rather than an afterthought.

To make sure vulnerability management wasn't just chasing CVSS scores, I worked with infrastructure and application teams to build a risk-based prioritization model — one that weighed business impact and operational feasibility alongside technical severity, so the team's limited remediation capacity went toward the vulnerabilities that actually mattered most.

I also led the development of a broader cybersecurity framework aligned to NIST CSF and CIS Controls, with audit processes built in to measure compliance posture over time. That gave leadership a defensible, standards-based way to track security maturity year over year, rather than relying on point-in-time assessments.