Technical Security Governance Lead - Exposure Management

The role

You will act as the technical lead for exposure management, investigating suspected security weaknesses across WPP's global technology environment. You will decide which exposures are genuinely exploitable and which matter most, and direct teams to the fixes that will reduce risk most. You will not own every fix.

What you will do

• Act as WPP's technical Principal for Exposure Management, giving senior technical judgement on attack paths and systemic exposure.
• Investigate suspected vulnerabilities across infrastructure, operating systems, identity, cloud, applications, data and AI.
• Combine information from multiple sources to determine what is exploitable, how weaknesses connect and what matters.
• Assess attack paths and systemic exposure, separating significant enterprise risk from isolated findings.
• Establish technical priorities for mitigation across teams.
• Work with TSG specialists to understand findings and make recommendations to system owners.
• Provide broad technical security expertise, including encryption, security tooling and emerging threats.
• Support major security events with rapid investigation, exposure analysis and remediation prioritisation.
• Improve how WPP understands exposure by identifying recurring patterns and challenging assumptions.

Required qualifications

• Hands-on technical security experience, with meaningful practical experience investigating, defending or validating real enterprise technology.
• Strong foundations across networks, infrastructure, operating systems, identity, cloud, applications or security operations.
• Practical attacker and defender knowledge, including vulnerabilities, exploitability, attack paths and defensive controls.
• Strong investigative and critical-thinking skills.
• Good judgement on prioritisation.
• Professional English to investigate, collaborate and communicate across a global organisation.
• Ability to work primarily from WPP's São Paulo office.

Nice to have

• Practical experience in Red Team, Blue Team, Purple Team, Vulnerability Management, Exposure Management, Security Engineering, Security Research, Vulnerability Research, adversarial validation or atta
• Experience translating complex technical findings into clear priorities for other teams.
• Experience across multiple technology domains.
• Experience working with substantial autonomy.
• Experience influencing outcomes through expertise rather than authority.
• Strong communication skills with technical specialists and senior stakeholders.
• Experience with enterprise vulnerability, attack-surface, exposure, BAS or security-posture platforms.
• Experience investigating exposure across cloud, identity, applications, AI or agentic systems.
• Experience supporting major incidents or urgent remediation programmes.
• Experience designing or improving security methodologies, processes, metrics or prioritisation approaches.

Benefits

• Passionate, inspired colleagues.
• Scale and opportunity to complete projects at industry-leading scale.
• Challenging and stimulating creative problem-solving work.

Before you apply

• Hybrid arrangement with teams in the office around four days a week; accommodations or flexibility can be discussed with the hiring team.

About the company

WPP is a growth partner for leading brands, combining media intelligence, data, creativity, production, enterprise solutions and strategic counsel. It works with major brands across 100+ markets.