Senior Engineer, Exposure & Vulnerability Management

The Senior Engineer, Exposure & Vulnerability Management will lead the evolution of enterprise security from periodic vulnerability scanning to continuous, risk-driven exposure management. In this role, you will design intelligent, automated systems that identify, prioritize, remediate, and verify security exposures across cloud, on-premise infrastructure, applications, and corporate environments. You will leverage AI agents, automation, and real-time threat intelligence to distinguish genuinely exploitable vulnerabilities from lower-risk findings. Working closely with Engineering, IT, and Information Security teams, you will embed secure-by-default practices into development and operational workflows. You will also strengthen governance through approval controls, audit trails, measurable security outcomes, and compliance-focused processes. This is an opportunity to shape a proactive security strategy while applying advanced automation to protect complex technology environments.

The ideal candidate is an experienced security engineer with a strong background in vulnerability and exposure management, cloud security, and automation. You should combine strategic program ownership with hands-on technical expertise, particularly in AI-driven security workflows and risk-based remediation. Key qualifications include:

• Bachelor's or Master's degree in Computer Science, Information Security, or a related field, or equivalent practical experience.

• At least 7 years of experience in vulnerability management, exposure management, or related information security domains.

• Demonstrated experience leading large-scale security programs from strategy through execution in cloud-first and hybrid environments.

• Deep understanding of security principles and proven ability to translate vulnerability data into prioritized, assigned, and verified remediation actions.

• Hands-on experience building or deploying AI/LLM-based agents or multi-agent systems for security or engineering workflows, including orchestration, tool usage, and evaluation.

• Working knowledge of approval workflows, audit logging, and rollback controls for automated remediation, including an understanding of the risks associated with agent-driven changes.

• Proficiency in one or more programming languages, such as Python, Go, or Java, with strong scripting and automation capabilities.

• Advanced experience with vulnerability and exposure management platforms such as Tenable, Qualys, Rapid7, or equivalent solutions.

• Familiarity with CTEM, attack surface management, and attack-path analysis tools and methodologies.

• Strong command of risk-based vulnerability prioritization frameworks and intelligence sources, including CVSS, EPSS, CISA KEV, reachability analysis, and threat intelligence feeds.

• Experience with cloud platforms such as AWS, Azure, or GCP.

• Knowledge of container and Kubernetes security, as well as Infrastructure-as-Code tools such as Terraform and CloudFormation.

• Experience with CI/CD pipelines, SCA/SAST tools, and software supply chain security practices, including SBOMs and dependency mapping.

• Strong understanding of operating systems, including UNIX/Linux, macOS, and Windows, as well as networking and database management systems.

• Experience with security risk management and aligning technical solutions with organizational risk tolerance and compliance requirements, such as SOC 2 or GxP.

• Strong analytical, problem-solving, and communication skills, with the ability to collaborate across technical teams and translate security risks into actionable priorities.

Preferred Qualifications:

• Relevant security certifications such as CISSP, OSCP, or GWAPT.

• Experience designing and implementing continuous exposure management programs in complex enterprise environments.

• Familiarity with regulated technology or life sciences environments and their security and compliance requirements.