Security Engineer – ConMon

This is a fully remote position, open to applicants in United States.

📋 Description

• Deliver operational support for vulnerability management processes for clients with regulatory compliance obligations.

• Become a part of a collaborative security operations team providing vulnerability management services to cloud service providers and organizations under stringent regulations.

• Relay security anomaly alerts to clients.

• Assist customers in scanning FedRAMP environments and managing false positives effectively.

• Develop Plans of Action and Milestones (POAMs) based on customer scan data.

• Share insights and suggested remediation strategies with internal management.

• Produce formal documentation, reports, and presentations.

• Serve as a liaison between vulnerability management, SRE, and customer teams.

• Set up and troubleshoot scanning devices.

• Create technical solutions to automate repetitive tasks.

• Offer guidance, instruction, and thought leadership to both clients and team members.

• Open and track tickets and customer requests.

• Investigate root causes of issues across various technologies.

• Coordinate efforts between Coalfire and client teams during escalations to facilitate swift resolutions.

⛳️ Requirements

• US citizenship is mandatory due to client contractual stipulations.

• Experience in supporting clients within a managed service organization.

• Familiarity with ITSM tools such as Jira and ServiceNow, along with meeting Service Level Agreements (SLAs).

• 2-4 years of experience in professional services, vulnerability management, and compliance monitoring.

• Proficient in web application testing, API testing, and network testing methodologies.

• Prior experience with Burp Suite Professional or similar Dynamic Application Security Testing (DAST) tools.

• Capability to analyze information security vulnerabilities and work collaboratively with teams for remediation.

• Experience with container scanning tools like Prisma, Aquasec, or Defender is preferred.

• Familiarity with developing playbooks, runbooks, and troubleshooting technical issues.

• Understanding of vulnerability scoring systems such as CVSS/CMSS.

• Experience with vulnerability scanning tools such as Nessus and Burp Suite.

• Ability to assess vulnerabilities and modify risk ratings based on internal factors.

• Knowledge of OS Baseline Configuration standards, including CIS Critical Security Controls Scanning.

• Experience working with auditors to ensure compliance with controls, policies, and standards.

• Strong documentation abilities, including the creation of technical diagrams and descriptions.

• Ability to work autonomously as well as collaboratively in a team, maintaining a professional attitude and demeanor.

• Critical thinking skills and ability to balance environmental requirements with mission objectives.

• Bachelor’s degree or higher in a relevant Information Technology field, or an equivalent combination of education and experience.

• Bonus: Previous experience supporting 24x7x365 security operations for a SaaS vendor.

• Bonus: Certifications such as PCI ASV, CISSP, CISA, cloud vendor, PMP, CISM, or CISA are a plus.

• Bonus: Familiarity with FedRAMP, FISMA, SOC, ISO, HIPAA, HITRUST, or PCI frameworks.

🏝️ Benefits

• Flexible work model that allows working from home or an office.

• Employee resource groups.

• Opportunities for in-person and virtual events.

• Paid parental leave.

• Flexible time off policy.

• Reimbursement for certification and training expenses.

• Membership for digital mental health and wellbeing support.

• Comprehensive insurance options available.

• Potential eligibility for annual incentives, commissions, and/or recognition programs.