Security Engineer, Vulnerability Management – Security Operations

This is a fully remote position, open to applicants in United States, +1 more country.

📋 Description

• Select, implement, and operationalize scanning tools across production assets.

• Manage vulnerability processes from start to finish, including triage, severity evaluation, owner assignment, remediation service level agreements, and reporting.

• Develop engineering-oriented triage and remediation workflows that align with existing engineering methodologies.

• Automate the routing of findings and subsequent follow-ups.

• Create a remediation dashboard for both engineering teams and leadership.

• Automate the gathering of vulnerability management evidence required for compliance programs in collaboration with the Compliance team.

• Establish automation, including agent-based tools, to minimize manual security operations and keep pace with engineering growth.

• Take full ownership of the vulnerability management and security operations program within the Trust team.

⛳️ Requirements

• A minimum of 5 years in security engineering, security operations, or software engineering, with a considerable focus on security.

• Practical experience in building or managing a vulnerability management program or software security tools, including software composition analysis (SCA), container, cloud, or host scanning.

• An engineering-first mindset towards triage and remediation.

• Ability to accurately assess the genuine severity of findings in the environment, utilizing CVSS as one of the metrics.

• Proficient scripting and automation skills in Go or Python.

• Familiarity with infrastructure as code, such as Terraform.

• A pragmatic view on risk and the capability to articulate business impact and urgency of remediation.

• Experience with real-time media, networking, or WebRTC systems is advantageous.

• Prior experience supporting HIPAA, PCI-DSS, ISO 27001, or SOC 2 compliance audits is a bonus.

• Background in incident response or application security is a plus.

• Experience in AI security, particularly in securing large language model applications or agent infrastructure, is a plus.

• Legally authorized to work in the US or the country of residence.

• Must specify whether future sponsorship support is necessary.

🏝️ Benefits

• Competitive salary.

• Equity package.

• Health, dental, and vision benefits.

• Flexible vacation policy.

• Opportunity to contribute to open source projects alongside top-tier engineers.