Sr. Security Engineer, Vulnerability Management
Full-Time | Remote / US
About the Role:
This role will be responsible for maturing a scalable vulnerability management discipline by driving continuous improvement through AI-driven automation, metrics, risk-based prioritization, and cross-functional alignment.
In this role, you will partner closely with Security Architecture, Security Engineering, IT, SRE, Compliance, and engineering teams to ensure that vulnerabilities across infrastructure, applications, and cloud environments are identified, prioritized, communicated, and remediated effectively.
Your technical aptitude, operational rigor, and collaboration skills will help drive the program forward. This position is hands-on and requires strong execution, sound judgment, and the ability to influence outcomes across teams without direct people leadership responsibility.
Key Responsibilities & Duties:
- Own and advance the enterprise vulnerability management lifecycle with a focus on scanning, triage, risk scoring, remediation tracking, validation, and continuous improvement.
- Leverage and modernize AI systems to automate patches and configuration changes, driving toward near real-time resolution of exploits.
- Optimize the vulnerability management platform and related tools, ensuring accurate, automated, and scalable coverage across infrastructure, applications, and cloud environments.
- Develop and deliver meaningful metrics and executive reporting to drive accountability, measure progress, and inform leadership on vulnerability posture and remediation performance.
- Communicate vulnerability status, remediation progress, and SLA performance through recurring updates and appropriate governance forums.
- Apply a risk-based prioritization model using CVSS, system criticality, threat intelligence, environmental context, and compensating controls to determine remediation urgency.
- Partner cross-functionally with the Red Team, IT, Engineering, SRE, Compliance, and service owners to identify, track, and mitigate risks tied to unsupported technologies, end-of-life systems, legacy services, and cloud-native vulnerabilities.
- Manage scanning exemptions and vulnerability exceptions, including documentation, business justification, review, remediation planning, and tracking through established processes.
- Help improve asset ownership, routing, and reporting coverage so vulnerability findings are consistently delivered to the correct teams and actioned effectively.
- Drive visibility and remediation of cloud misconfigurations, exposed services, over-permissioned identities, and other cloud-native risks in partnership with teams across the organization.
- Act as a technical leader in vulnerability risk management, influencing remediation strategies, prioritization decisions, and long-term technology lifecycle planning.
Required Qualifications:
- Bachelor’s degree in Computer Science, Information Security, or related field (or equivalent practical experience).
- 8+ years of experience in cybersecurity with at least 3 years focused on vulnerability management, risk management, or related security functions. SaaS environment experience is required.
- Hands-on expertise with vulnerability management platforms (e.g., Wiz, Tenable, Qualys, Rapid7, Vulcan, Kenna).
- Strong knowledge of vulnerability scoring frameworks (CVSS), patch management processes, remediation SLAs, and risk-based prioritization.
- Strong understanding of operating systems (Windows, Linux, macOS), networking, and cloud platforms (AWS, Azure, GCP).
- Experience with cloud security tools and CSPM/CNAPP platforms such as Wiz, Prisma Cloud, or Orca.
- Demonstrated ability to track, prioritize, and mitigate risks in partnership with IT, Engineering, SRE, and Compliance teams.
- Excellent problem-solving, analytical, and communication skills with the ability to influence stakeholders at all levels.
Desired Skills & Experience:
- Experience with cloud security tools and CSPM/CNAPP platforms such as Wiz, Prisma Cloud, or Orca.
- Experience with container security and cloud-native environments (Docker, Kubernetes, serverless).
- Knowledge of security frameworks and regulatory standards (NIST CSF, PCI DSS, SOC 2, ISO 27001).
- Experience automating remediation workflows or integrating vulnerability data into ticketing systems (e.g., Jira, ServiceNow).
- Background in threat modeling, exposure management, and risk assessment beyond patching.
- Relevant certifications such as CISSP, CISM, OSCP, GIAC/GVMS, or cloud security certifications.