Senior Vulnerability Management Engineer

We are seeking a Senior Vulnerability Management Engineer to support enterprise vulnerability management operations. This hands-on role requires strong vulnerability analysis, infrastructure security knowledge, and the ability to independently drive findings from identification and validation through remediation or risk acceptance.

Key Responsibilities

• Investigate and validate vulnerabilities identified through scanning and vulnerability management platforms.
• Analyze CVEs, CVSS scores, vendor advisories, patches, configurations, exploitability, and false positives.
• Assess vulnerabilities across infrastructure, operating systems, networking, middleware, platforms, containers, and DevOps technologies.
• Create vulnerability advisories, remediation tickets, and risk acceptance documentation.
• Partner with infrastructure, middleware, DevOps, application, and security teams to drive remediation.
• Manage vulnerability remediation workflows, SLAs, exceptions, and risk acceptance processes.
• Research emerging and time-sensitive vulnerabilities and coordinate appropriate response.
• Clearly communicate vulnerability risk and remediation requirements to engineers, managers, and leadership.

Required Skills

• 8+ years of hands-on experience in vulnerability management, cyber risk, or infrastructure security.
• Strong knowledge of CVEs, CVSS, exploitability, remediation, mitigation, and false-positive validation.
• Experience independently validating vulnerabilities beyond scanner results.
• Strong understanding of enterprise infrastructure, including operating systems, servers, networking, middleware, and platforms.
• Experience with vulnerability management tools such as Rapid7 InsightVM/Nexpose, Qualys, or Nucleus.
• Experience researching vendor security advisories, patches, software versions, and vulnerability intelligence.
• Experience coordinating remediation with technical engineering teams.
• Strong written, verbal, analytical, and stakeholder management skills.
• Experience with enterprise-scale vulnerability management programs.
• Experience with vulnerability advisories, remediation ticketing, risk acceptance, and exception management.
• Familiarity with CISA KEV, EPSS, exploitability analysis, and vulnerability prioritization.
• Experience with Jira, Ivanti, or similar workflow tools.
• Experience working within defined vulnerability remediation SLAs.