• Support the execution of Alpaca’s cybersecurity risk management program • Conduct cyber risk assessments across cloud infrastructure , APIs, trading systems, and internal platforms • Assist in identifying, documenting, and evaluating AI-related risks (model risk, data privacy, bias, explainability, adversarial threats, model misuse) • Help develop and maintain AI governance controls aligned with evolving regulatory expectations such as the EU AI Act • Perform third-party/vendor security and AI risk assessments • Contribute to control testing across frameworks such as SOC 2, ISO 27001, CSA Star, NIST CSF, and emerging AI governance standards • Track remediation efforts and maintain risk registers and reporting dashboards • Support internal and external audits by preparing documentation and evidence • Monitor regulatory developments related to cybersecurity, financial services, and AI governance • Help mature policies, standards, and procedures for both cyber and AI domains • Support the development of a repeatable AI tool/model evaluation process (intake → review → decision) for new and in-use AI tools • Support Alpaca's AI usage guidance and standards, including safe use of AI-enabled developer tools and assistants • Help maintain AI logging/monitoring standards (audit logging, evidence) for AI systems • Use AI tools in day-to-day work and help test how well AI-related controls are working

Role Description We are seeking a highly skilled Vulnerability Management Specialist responsible for driving end-to-end vulnerability lifecycle management, patch compliance, and security posture optimization. The role requires strong expertise in Qualys, remediation governance, and coordination with cross-functional teams to ensure proactive risk mitigation aligned with enterprise security standards. Key Responsibilities - Vulnerability Management & Scanning - Manage Qualys agent deployment and lifecycle in collaboration with the IT Asset Management (ITAM) team - Conduct and govern scheduled vulnerability scans: - Weekly internal scans - Monthly external scans - Ensure scan coverage, accuracy, and alignment with organizational policies - Remediation Governance & Execution - Drive wave-based remediation pipeline, including: - Planning and prioritization - Validation in test environments - Defined acceptance criteria before production rollout - Lead criticality-based remediation strategy: - Prioritize Critical → High → Medium vulnerabilities - Conduct post-remediation validation through Qualys re-scanning - Risk & Exception Management - Manage exceptions and compensating controls with proper documentation and approvals - Coordinate risk acceptance processes with stakeholders and security leadership - Ensure audit readiness and compliance with internal and regulatory standards - Patch & Compliance Monitoring - Track and enforce patch compliance across systems - Publish monthly security posture and compliance reports to the CISO office - Identify trends, gaps, and improvement areas in patching and vulnerability closure - System Hardening & Security Improvements - Drive hardening initiatives for system images and configurations - Support manual remediation and configuration-fix workflows where automation is not feasible - Collaborate with engineering teams to institutionalize secure baselines - Segmentation & Security Posture Management - Implement and manage asset segmentation (Red / Yellow / Green classification) - Enable lab manager and environment-level security controls - Establish and maintain audit cadence for continuous improvement Qualifications - Strong hands-on experience with Qualys Vulnerability Management platform - Deep understanding of vulnerability lifecycle management and remediation frameworks - Experience with patch management, OS hardening, and security configurations - Knowledge of risk management, exception handling, and compliance reporting - Familiarity with enterprise IT infrastructure (servers, networks, endpoints) Preferred Qualifications - Certifications such as CISSP, CEH, CompTIA Security+, or equivalent - Experience working with CISO office or security governance teams - Exposure to audit frameworks (ISO 27001, NIST, CIS benchmarks) Key Competencies - Strong analytical and problem-solving ability - Stakeholder management and cross-functional coordination - Structured and process-oriented mindset - Ability to drive execution under tight timelines

• Assists in enhancing information security, information governance, privacy, compliance, and risk management procedures. • Collaborates with university business and academic leaders to enhance control processes. • Evaluates the effectiveness of existing security controls and recommends enhancements. • Administers audit and security governance, risk, and compliance (GRC) tools. • Maintains knowledge of key NIST controls and enhances IT controls and policies. • Prepares team members and necessary materials for audit meetings. • Builds testing and validation of IT General Control (ITGC) processes for internal audit. • Supports implementation and ongoing maintenance of controls aligned with CMMC and NIST SP 800-171 requirements. • Collaborates with internal stakeholders and third-party vendors for data protection alignment. • Contributes to development of CMMC aligned policies, standards, and procedures.

• Facilitate security incidents to a prompt resolution • Identify opportunities to improve overall lifecycle management of products • Eliminate or reduce the impact of service outages and problems within The Home Depot • Coordinate and ensure major events are well-communicated and are driven to completion • Real-time monitoring and notifications of high-profile events • Instant action on adverse effects