Senior Director, Vulnerability Management & Penetration Testing

Job Summary:

WHO ARE WE?

Live Nation Entertainment is the world’s leading live entertainment company, comprised of global market leaders: Ticketmaster, Live Nation Concerts, and Live Nation Media & Sponsorship. Ticketmaster is the global leader in event ticketing with over 620 million tickets sold annually and approximately 10,000 clients worldwide.  Live Nation Concerts is the largest provider of live entertainment in the world promoting more than 50,000 events annually for nearly 7,000 artists in 40+ countries. These businesses allow Live Nation Media & Sponsorship to create strategic music marketing programs that connect more than 1,200 sponsors with the 145 million fans that attend Live Nation Entertainment events each year. For additional information, visit www.livenationentertainment.com .

WHO ARE YOU?

Passionate and motivated. Driven, with an entrepreneurial spirit. Resourceful, innovative, forward thinking and committed. At Live Nation Entertainment, our people embrace these qualities, so if this sounds like you then please read on!

THE ROLE

We are seeking a Senior Director to lead our Defect Management (Vulnerability Management) and Penetration Testing teams, which span penetration testing, vulnerability management, bug bounty program management, and defect remediation.

Reporting to the Vice President, Governance, Risk and Compliance (GRC) and Operations, you will lead a multi-disciplinary team and partner with cross-functional teams across regions to ensure vulnerabilities are prioritized, remediated, and monitored to protect Live Nation Entertainment’s assets and data. You will clearly communicate the business impact and urgency of security defects while following the defined risk management process, and you will define the outcomes and metrics for Defect Management across the enterprise.

This is a delivery-focused leadership role: you own program plans, roadmap commitments, and remediation service-level agreements (SLAs), and you are accountable for measurable, on-time reductions in enterprise vulnerability exposure.

WHAT THIS ROLE WILL DO

- Build and lead a high-performing, multi-disciplinary security team across multiple locations

- Set the team’s strategic direction and development, lead by example, and mentor team members at all levels

- Research and communicate emerging security threats relevant to the environments we operate

- Participate in threat modeling, security design reviews, penetration testing, and remediation verification

- Partner with application teams enterprise-wide to detect, prioritize, and remediate security defects throughout the SDLC, embedding a security mindset from concept through implementation, including hands-on security training for architects and developers

- Set clear priorities and deadlines and hold the team accountable for timely, high-quality delivery

- Own budget, headcount planning, and resource allocation for both teams, including tooling, third-party testing, vendor, and bug bounty spend

- Lead response to zero-day vulnerabilities and urgent exploits: coordinate with Cyber Security Operations, Threat Intelligence, and internal/external business partners, communicate clearly and promptly to leadership and stakeholders, and track each issue to closure. Requires 24/7 availability for urgent matters

- Partner with Cyber Security Operations and Threat Intelligence on red and purple team exercises to validate detection and response and prioritize remediation of exploitable paths

Program Management & Delivery

- Own program goals and roadmap commitments; build project plans with milestones, risks, and deadlines; escalate blockers early and deliver on time

- Drive measurable reduction in vulnerability exposure, including Known Exploited Vulnerabilities (KEV) and aged backlog, and remediate all Critical vulnerabilities within regulatory timeframes (ex. PCI DSS)

- Establish and enforce risk-based remediation SLAs, exception and risk-acceptance criteria, compensating controls, and escalation paths; track exceptions to closure

- Own scanning and assessment coverage across on-premises, cloud, container, application, and API environments, including authenticated coverage and discovery of unmanaged, shadow, and end-of-life assets

- Lead the bug bounty program end-to-end, from submission through triage, assignment, remediation, retesting, and closure, with SLA and aging reporting at every stage

- Lead security testing of AI-enabled products, including LLM-based and agentic applications, incorporating AI-specific threats (e.g., OWASP Top 10 for LLM Applications) into testing methodologies

- Drive automation and AI-enabled integrations across CMDB, ITSM, scanning, and bug bounty platforms to automate ownership mapping, ticket routing, SLA tracking, and reporting

- Select, implement, and continuously evaluate security testing tooling (coverage, cost, overlap), including continuous and agentic penetration-testing platforms; own the penetration-testing and scanning infrastructure; and make evidence-based retain/discontinue recommendations with transition plans

- Align the program to PCI DSS, CIS Controls, SOC 1/SOC 2, CCPA, NIS2, and other applicable requirements; maintain audit evidence and support audits, assessments, and security reviews

- Establish processes to assign, track, and remediate findings from external security-rating and third-party risk services

Business Stakeholder Management & Executive Reporting

- Build trust and collaboration across business and technology stakeholders with competing priorities through regular, transparent, data-driven communication, and track stakeholder commitments to completion

- Lead recurring stakeholder reviews of goals, progress, and blockers, ensuring decisions and actions are documented and followed through

- Produce executive-ready metrics (coverage, SLA attainment, risk burn-down, exceptions, business impact) and present program status and risks to senior leadership

External Partner & Vendor Management

- Manage third-party vendors and PCI ASV/QSA engagements, including scoping, quality review, and remediation tracking

- Hold vendors accountable to contractual SLAs; document failures, pursue service credits, and report on vendor effectiveness

WHAT THIS PERSON WILL BRING

- Knowledge of Cyber Security standards and regulations, including PCI DSS, CIS Controls, SOC 2, CCPA, and NIS2, and of desktop, server, application, database, and network security principles; experience maintaining audit evidence

- Experience performing penetration testing and exploitation against applications, APIs, web, mobile, and modern infrastructure (containers, microservices, serverless) in cloud (AWS, Azure) and on-premises environments

- Track record of building and managing large, diverse teams: attracting, hiring, developing, and retaining top security talent and giving them the vision, support, and culture to deliver impact

- High ethical standards and discretion with confidential information

- Technical knowledge of adversary Tactics, Techniques, and Procedures (TTPs)

- Understanding of common software security issues and remediation techniques (CISA KEV, OWASP Top 10, SANS 25, MITRE, etc.)

- Deep knowledge of the threat landscape and emerging security strategies and products

- Strong program management discipline: builds project plans with milestones, risks, and deadlines, communicates status proactively, and delivers on time

- Attention to detail and a sense of urgency in prioritizing and responding to time-sensitive security issues

- Experience operating a bug bounty or vulnerability disclosure program and managing security vendors, third-party penetration-testing firms, SLAs, and reporting

- Experience managing remediation against compliance-driven SLAs, including PCI DSS requirements, and governing exceptions and risk acceptance

Desirable

- 10+ years in technical security roles, including penetration testing or security hardening

- 5+ years driving cyber security initiatives across large, diverse organizations

- Experience working in global environments spanning multiple time zones

- Training in Cyber Security-specific disciplines

- Advanced written and verbal communication skills with technical and non-technical audiences, including senior leadership

- Relevant industry certifications (e.g., OSCP, OSCE, GPEN, GWAPT, CISSP, CISM)

BENEFITS & PERKS

Our motto is ‘Taking Care of Our Own’ through 6 pillars of benefits:

- HEALTH : Medical, vision, dental and mental health benefits for you and your family, with access to a health care concierge, and Flexible or Health Savings Accounts (FSA or HSA)
- YOURSELF : Free concert tickets, generous paid time off including paid holidays, sick time, and personal days
- WEALTH : 401(k) program with company match, stock reimbursement program
- FAMILY : New parent programs including caregiver leave and baby bonuses, plus fertility, adoption, foster, or surrogacy support
- CAREER : Career and skill development programs with School of Live, tuition reimbursement, and student loan repayment
- OTHERS : Volunteer time off, crowdfunding match

EQUAL EMPLOYMENT OPPORTUNITY

We aspire to build teams that reflect and support the fans and artists we serve. Every day we aim to promote environments where everyone can be themselves, contribute fully, and thrive within our company and at our events. As a growing business we will encourage you to develop your professional and personal aspirations, enjoy new experiences, and learn from the talented people you will be working with.

Live Nation strongly supports equal employment opportunity for all applicants regardless of age (40 and over), ancestry, color, religious creed (including religious dress and grooming practices), family and medical care leave or the denial of family and medical care leave, mental or physical disability (including HIV and AIDS), marital status, domestic partner status, medical condition (including cancer and genetic characteristics), genetic information, military and veteran status, political affiliation, national origin (including language use restrictions), citizenship, race, sex (including pregnancy, childbirth, breastfeeding and medical conditions related to pregnancy, childbirth or breastfeeding), gender, gender identity, and gender expression, sexual orientation, intersectionality, or any other basis protected by applicable federal, state or local law, rule, ordinance or regulation.

We will consider qualified applicants with criminal histories in a manner consistent with the requirements of the Los Angeles Fair Chance Ordinance, San Francisco Fair Chance Ordinance and the California Fair Chance Act and consistent with other similar and / or applicable laws in other areas.

We also afford equal employment opportunities to qualified individuals with a disability. For this reason, Live Nation will make reasonable accommodations for the known physical or mental limitations of an otherwise qualified individual with a disability who is an applicant consistent with its legal obligations to do so, including reasonable accommodations related to pregnancy in accordance with applicable local, state and / or federal law. As part of its commitment to make reasonable accommodations, Live Nation also wishes to participate in a timely, good faith, interactive process with a disabled applicant to determine effective reasonable accommodations, if any, which can be made in response to a request for accommodations. Applicants are invited to identify reasonable accommodations that can be made to assist them to perform the essential functions of the position they seek. Any applicant who requires an accommodation in order to perform the essential functions of the job should contact a Human Resources Representative to request the opportunity to participate in a timely interactive process.  Live Nation will also provide reasonable religious accommodations on a case-by-case basis.

HIRING PRACTICES

The preceding job description has been designed to indicate the general nature and level of work performed by employees within this classification. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities, and qualifications required of employees assigned to this job.

Live Nation recruitment policies are designed to place the most highly qualified persons available in a timely and efficient manner. Live Nation may pursue all avenues available, including promotion from within, employee referrals, outside advertising, employment agencies, internet recruiting, job fairs, college recruiting and search firms.

#LI-EF1

#LI-HYBRIDLOSANGELES,CA

#LI-REMOTECALIFORNIA

#LI-REMOTEUNITEDSTATES

#LI-REMOTEFLORIDA

#LI-REMOTEWASHINGTON

#LI-HYBRIDATLANTA,GA

#LI-REMOTENEWMEXICO

----------

The expected compensation for this position is:
$174,000.00 USD - $218,000.00 USD
** Pay is based on a number of factors including market location, qualifications, skills, and experience.

Live Nation Entertainment will never request payment or equipment purchases as part of the hiring process. Recruiters will only contact candidates from official Live Nation or affiliated brand email domains.