IAM Engineer (ASM - Attack Surface Management - Scanning) L2

KEY RESPONSIBILITIES AND DUTIES:

• Lead the end-to-end vulnerability management lifecycle, including discovery, assessment, validation, prioritization, remediation coordination, and verification.
• Conduct vulnerability assessments across infrastructure, web applications, cloud environments (AWS, Azure, Google Cloud Platform), and containerized platforms.
• Perform Dynamic Application Security Testing (DAST) and manual validation of security vulnerabilities.
• Analyze and prioritize vulnerabilities using CVSS, EPSS, CISA advisories, exploit intelligence, and business risk.
• Manage and optimize vulnerability scanning tools, asset discovery processes, and reporting mechanisms.
• Collaborate with Infrastructure, DevOps, Engineering, Cloud, and Security teams to drive remediation efforts.

"MUST HAVE" SPECIFIC KNOWLEDGE AND SKILLS:

• 5+ years of experience in Vulnerability Management, Application Security, or Penetration Testing.
• Hands-on experience with vulnerability management tools such as Tenable (NessVMDR), Wiz, Qualys, Rapid7, Burp Suite, OWASP ZAP, Checkmarx, Veracode, and Insight AppSec.
• Strong knowledge of OWASP Top 10, SANS Top 25, CVSS, EPSS, and CISA vulnerability prioritization frameworks.
• Experience identifying, validating, and remediating vulnerabilities across web applications, networks, systems, and cloud environments.
• Proficiency in web application security testing, including SQL Injection (SQLi), Cross-Site Scripting (XSS), CSRF,
• SSRF, IDOR, and Authentication Bypass testing.
• Experience with cloud security assessments in AWS, Azure, and/or Google Cloud Platform.

ADDITIONAL SKILLS AND OTHER REQUIREMENTS:

• Certifications such as OSCP, GWAPT, CEH, CSSLP, or equivalent.
• Experience with penetration testing and application security architecture reviews.
• Knowledge of compliance frameworks including PCI DSS, GDPR, HIPAA, CIS, NIST, and ISO standards.
• Experience with external attack surface management and third-party risk tools such as Shodan, SSLScan,
• SecurityScorecard, and BitSight.
• Knowledge of container security and cloud-native vulnerability scanning.
• Experience integrating security testing and vulnerability management into CI/CD pipelines.
• Scripting/programming skills in Python, PowerShell, Bash, JavaScript, Java, or C#.
• Ability to drive remediation SLAs, vulnerability governance, and executive reporting initiatives.