Senior Engineer, Exposure & Vulnerability Management

Role overview Lead the shift from periodic vulnerability scans to continuous, risk-focused exposure management across cloud, on-premises, product, and corporate environments. You will build automated workflows that assess real exploitability, prioritize meaningful risks, and move verified fixes to closure with appropriate review and audit controls.

Responsibilities - Design multi-agent workflows that discover exposures, map dependencies, propose code or infrastructure fixes, and verify remediation, with approval gates, audit trails, and rollback safeguards. - Prioritize findings using reachability, attack paths, business importance, and current exploit intelligence rather than severity scores alone. - Automate checks that distinguish exploitable conditions from theoretical findings, reducing alert noise for engineering and operations teams. - Set and advance a continuous threat exposure management strategy, including asset discovery, inventory, and remediation workflows. - Integrate findings and fixes with ticketing, CI/CD, and configuration management systems to reduce manual handoffs. - Work with engineering and IT on secure defaults, risk-based remediation timelines, program metrics, and controls that support compliance.

Requirements - Degree in computer science, information security, or a related area, or equivalent practical experience. - At least 7 years in vulnerability or exposure management, or a related security field, including leading programs from strategy through delivery in cloud-first or hybrid environments. - Strong record of turning vulnerability data into prioritized, assigned, and verified fixes. - Practical experience building or deploying AI/LLM agents or multi-agent systems for security or engineering workflows, including orchestration, tool use, and evaluation. - Understanding of approval processes, audit logging, rollback controls, and risks associated with automated remediation. - Proficiency in a programming language such as Python, Go, or Java, plus scripting for automation and integration. - Experience with vulnerability and exposure management platforms is expected; the available source does not preserve the complete list of platforms or remaining qualifications.

Nice to have - Experience supporting security controls for standards such as SOC 2. - Familiarity with zero-trust security practices and cloud-native environments.