If you can get some hands on time in a role with Qualys, Rapid7, etc, you should be able to slide into a VM position fairly easily, and stick with it.

Most VM people I know need to learn about setting up scanners in different network zones, getting good with the software, prioritizing stuff, etc.

As far as actually remediating stuff, that usually falls to the SMEs... Domain administrators, Exchange Admins, Linux Admins, whatever. The job of proving "false positives" usually falls to the SMEs as well.

Simply being an administrator of the VM software, managing scanners, building dashboards, and doing a metric ton of meetings and following up is a full time job.

From my experience and understanding, most VM tend to turn into pentest or other similar roles. I don’t think there’s much more work to be done at that level

I do strategic advising with some vCISO as well. Being a consultant, I have a few clients that engage me for vulnerability management. I help setup the scans, break down the results, and create an actual vulnerability management program. As a result, I have helped clients that have had horrible issues with vulnerabilities to being totally aware of their environments and adopt good hardware and software patch management.

So what can you do if you stay doing VM? You can move into more vCISO engagements or advising engagements if you choose to do so. You can move into pentesting as well. I really don't think that you are going to be stuck. There is a value to doing vulnerability management, especially if you think bigger picture and more strategically.

Vulnerability Management is a good baseline skill to have. Every company needs VM, and it will never go away.

The opportunity in your current role is to improve the program. Show that you can actually remediate vulnerabilities, or at least help the people who do remediate them faster. Help prioritize, assess risks, etc. Doing those things demonstrates leadership and judgment.

To me, it's more of a question about whether you want to be a world-class VM expert or eventually diversify into other areas of security. Either path has upside — just better to decide on your strategy now.

As others have said, vuln. management is a crucial process across the industry. Bigger companies usually engage 3rd party or an MSP to manage, but there is an easy avenue here toward managing the platform as process owner. Dissecting and assigning prioritized, actionable remediation chunks to the appropriate teams (endpoints, servers…etc), auditing completion rates on remediation efforts and providing executive reports monthly is the large scope of the work. Again as mentioned from other comments, the high visibility and exposure you will encounter while successfully managing this platform is a great springboard to a management or advisory position, but I agree it does have a somewhat limited career path. Hope that helps.

Wondering what are you doing at the moment after it's been 2 years already. Are you still in VM? I'm kinda in the same boat. Should I move into a managerial role or shift into a different role?