Senior Security Research Engineer

Role overview

A senior engineering role leading vulnerability management capabilities while transitioning the program toward a continuous threat exposure management operating model. The position blends hands-on security research and validation with technical program leadership across discovery, prioritization, remediation, and reporting.

Responsibilities

- Lead complex vulnerability management workstreams spanning discovery, prioritization, validation, and mobilization across diverse technology environments. - Translate annual program goals into delivery plans, milestones, success measures, dependencies, and repeatable operating practices. - Conduct hands-on vulnerability research and technical analysis to confirm conditions, eliminate false positives, characterize exploitability, and provide actionable remediation guidance. - Develop risk-based prioritization using threat intelligence, exploitation evidence, asset and business context, and control effectiveness. - Lead security validation activities and develop proofs of concept to evaluate defensive controls and distinguish material risk. - Partner with security and engineering teams to clarify ownership, mobilize remediation, and resolve barriers to closure. - Evolve underlying platforms, integrations, data, analytics, automation, and AI-enabled workflows to improve coverage and decision speed. - Communicate trends, risks, and program outcomes to technical, operational, and leadership audiences. - Mentor engineers and contribute to technical standards and procedures.

Requirements

- 8+ years of experience in information security, information technology, systems engineering, or a related field, with substantial experience in vulnerability management, security research, or exposure management. - Bachelor's degree or equivalent in computer science, information security, or a related discipline. - Demonstrated success leading complex technical workstreams across multiple teams and translating objectives into measurable outcomes. - Hands-on experience with vulnerability research, technical analysis, security validation, risk-based prioritization, and remediation guidance. - Experience assessing vulnerabilities across operating systems, networks, cloud services, applications, endpoints, containers, databases, or hybrid infrastructure. - Familiarity with vulnerability discovery, assessment, validation, or exposure-management platforms and their integrations. - Knowledge of adversarial tactics, exploitation techniques, threat intelligence, and frameworks such as MITRE ATT&CK. - Experience using scripting, programming, APIs, or automation to improve security analysis and operational workflows.

Nice to have

- Experience with continuous security validation, adversarial exposure validation, exploit research, or proof-of-concept development. - Background securing cloud, container, application, or build-pipeline environments and embedding security into engineering workflows. - Experience with security-data and analytics platforms such as Snowflake, Domo, or comparable tools. - Experience applying automation, advanced analytics, or AI-enabled capabilities to vulnerability analysis, prioritization, validation, or remediation.

Benefits and work setup

- Flexible role that can be performed remotely, with pay ranges varying by geographic location; an estimated base pay range of $175,500–$263,300 USD is listed for candidates based in Seattle. - Comprehensive benefits package typically including medical, dental, vision, retirement plan matching, paid time off, a wellness program, and employee product discounts. - Bonus package eligibility for the role. - Some travel may be required.