Vulnerability Management Engineer

Role overview

Drive risk-based vulnerability and exposure management across infrastructure, applications, cloud services, endpoints, and software dependencies. The work centers on determining which findings are actually reachable and exploitable in the organization’s environment, then directing timely response or remediation. This role blends security analysis, threat intelligence, automation, and collaboration with offensive security specialists.

Responsibilities - Correlate vulnerability and threat data with asset inventories, configurations, application test results, network exposure, ownership, and business importance. - Prioritize findings using practical exploitability, reachability, active exploitation, adversary behavior, and environmental context—not severity scores alone. - Decide when an exposure warrants urgent incident response and when it can be handled through planned remediation objectives. - Use AI-assisted analysis to connect vulnerability intelligence with real system configurations, independently checking the resulting conclusions. - Work with a red team to validate whether significant vulnerabilities can be exploited in practice. - Identify interim safeguards, such as access restrictions or segmentation, and automate intake, prioritization, tracking, mitigation, and verification where appropriate.

Requirements - Experience in enterprise vulnerability or exposure management. - Strong understanding of infrastructure, applications, cloud, containers, networks, and software dependencies. - Ability to interpret vulnerability intelligence and assess real-world exploitability. - Knowledge of risk-based prioritization, including CVSS, exploit prediction, known-exploitation data, and environmental context. - Experience correlating security findings with asset, configuration, application testing, or endpoint data. - Scripting, automation, or data analysis experience, along with knowledge of OWASP Top 10, MITRE ATT&CK, MITRE D3FEND, and STRIDE.

Nice to have

Experience with continuous exposure management, attack-path analysis, AI-assisted security analysis, or automated mitigation. Familiarity with security guidance for large language model and agentic applications, and frameworks such as MITRE ATLAS and MAESTRO.