Technical Security Governance Lead - Exposure Management
WPP is the trusted growth partner for the world’s leading brands.
We unite cutting-edge media intelligence and data solutions, world-class creativity, next-generation production, transformative enterprise solutions and expert strategic counsel in a single company – powered by exceptional talent and our agentic marketing platform, WPP Open, to help our clients navigate change, capture opportunity and deliver transformational growth.
We work with the world's most valuable brands and have global reach across 100+ markets, with deep local expertise.
Our people are the key to our success. We're committed to fostering a culture of creativity, belonging and continuous learning, attracting and developing the brightest talent, and providing exciting career opportunities that help our people grow.
For more information, visit WPP.com.
Why we're hiring:
We are looking for a Technical Security Governance Lead – Exposure Management to help build, mature, and govern a modern exposure management capability across our global environment.
This role focuses on understanding how attackers see us—across external, internal, and AI-enabled environments—and ensuring the organization continuously validates, prioritizes, and reduces real-world attack opportunities.
This is a highly strategic, lead-level role for someone who understands modern attack paths and wants to shape how security is measured and improved. You will move beyond theoretical risk into practical attacker realism—governing the adversarial testing programs, attack surface visibility, exploitability validation, and attack path analysis that keep WPP secure.
What you'll be doing:
Technical Security & Exposure Governance
- Define and shape the governance framework, guardrails, and minimum standards for continuous exposure management across WPP.
- Drive continuous improvement in attack surface visibility, control effectiveness, and risk-driven exposure governance.
- Establish escalation thresholds for validated exploitable paths and constructively challenge delayed remediations.
Adversarial Assurance Governance
- Oversee and govern continuous adversarial testing and offensive validation programs across infrastructure, applications, APIs, cloud, and identity.
- Partner with and govern specialist external providers to validate real-world exploitability and attack paths.
- Help internal teams understand where technical weaknesses translate into realistic attack opportunities.
AI Adversarial Testing Governance
- Shape and govern the adversarial testing approaches for AI and agentic systems, a rapidly growing and critical domain for WPP.
- Support and oversee testing for modern AI risks, including prompt injection resilience, tool misuse, data leakage scenarios, and agent permission boundaries.
- Collaborate with product and AI teams to mature security controls and drive safer AI adoption.
Attack Surface & Path Analysis
- Maintain strategic visibility of WPP’s external-facing assets, governing unknown asset discovery, internet exposure drift, and shadow IT.
- Map and analyze complex attack paths across identity boundaries, privilege escalation routes, lateral movement pathways, and cloud trust relationships.
- Identify and escalate systemic exposure patterns to prevent recurring vulnerabilities.
What you'll need:
Experience & Qualifications:
- 5+ years of experience in offensive security, exposure management, red teaming, or attack surface management.
- Strong technical understanding of attacker tradecraft, adversarial testing methodologies, and modern attack techniques (e.g., EASM, BAS, Attack Path Analysis).
- Proven experience analyzing attack paths within cloud- and identity-based environments.
- Interest or experience in AI security and emerging AI attack models.
- Education & Certifications: Bachelor’s degree in Information Security, Computer Science, or a related field (or equivalent practical experience). Industry certifications such as OSCP, CREST, or CISSP are highly regarded.
Personal Attributes:
- Strategic & Impact-Focused: Ability to align technical security exposure with broader business risks and goals.
- Collaborative Leader: Strong relationship-building skills to work effectively with diverse, global teams and influence remediation without direct authority.
- Proactive & Accountable: A self-starter with a strong sense of ownership, comfortable navigating a fast-paced, dynamic environment.
Who you are:
You're open_:_ We are inclusive and collaborative; we encourage the free exchange of ideas; we respect and celebrate diverse views. We are open-minded: to new ideas, new partnerships, new ways of working.
You're optimistic_:_ We believe in the power of creativity, technology and talent to create brighter futures or our people, our clients and our communities. We approach all that we do with conviction: to try the new and to seek the unexpected.
You're extraordinary: we are stronger together: through collaboration we achieve the amazing. We are creative leaders and pioneers of our industry; we provide extraordinary every day.
What we'll give you:
Passionate, inspired people – We aim to create a culture in which people can do extraordinary work.
Scale and opportunity – We offer the opportunity to create, influence and complete projects at a scale that is unparalleled in the industry.
Challenging and stimulating work – Unique work and the opportunity to join a group of creative problem solvers. Are you up for the challenge?
#LI-Hybrid
We believe the best work happens when we're together, fostering creativity, collaboration, and connection. That's why we’ve adopted a hybrid approach, with teams in the office around four days a week. If you require accommodations or flexibility, please discuss this with the hiring team during the interview process.
WPP is an equal opportunity employer and considers applicants for all positions without discrimination or regard to particular characteristics. We are committed to fostering a culture of respect in which everyone feels they belong and has the same opportunities to progress in their careers.