Senior Cyber Security Engineer

This is a fully remote position, open to applicants in Wisconsin.

📋 Description

• Identify, evaluate, and mitigate cybersecurity risks within Direct Supply’s technological environments.

• Manage vulnerability operations, encompassing processes, security scanning tools, and coverage throughout infrastructure, cloud, and application domains.

• Analyze and prioritize vulnerabilities based on their exploitability, the criticality of assets, and potential business impact.

• Collaborate with engineering and operations teams to coordinate remediation efforts, monitor progress, verify fixes, and escalate unresolved risks.

• Automate workflows related to scanning, ticketing, and reporting.

• Track and report on security performance metrics, such as scanning coverage, remediation progress, overdue vulnerabilities, and recurrent risks.

• Plan and carry out both internal and external penetration testing.

• Validate security vulnerabilities and attack vectors through automated discovery, manual testing, and controlled exploitation.

• Manage relationships with external penetration testing providers, including defining scope, scheduling, access, and deliverables.

• Facilitate the resolution and retesting of findings from penetration tests.

• Analyze root causes, suggest enhancements to system designs and configurations, and share technical insights.

• Report to the Director of Information Security while collaborating with engineering, operations, and security teams.

⛳️ Requirements

• A Bachelor’s degree in Computer Science, Engineering, Information Security, or a related discipline.

• Over 6 years of progressive experience in information security or security engineering, with hands-on involvement in vulnerability management and penetration testing.

• Proven expertise in vulnerability assessment, security scanning tools, asset coverage, finding validation, and risk-based prioritization.

• Practical experience in conducting both internal and external penetration tests, including manual validation, controlled exploitation, security risk assessments, and technical reporting.

• Familiarity with operating, configuring, and troubleshooting security platforms, along with automating security workflows.

• Experience in assessing vulnerabilities and security risks across infrastructure, cloud, and application environments, especially in complex cloud settings.

• Capability to independently investigate intricate security issues, identify root causes, and recommend effective corrective measures.

• Experience in coordinating external security testing providers and communicating technical findings, remediation priorities, and security risks to technical stakeholders and leadership.

• Preferred certifications include OSCP, GPEN, GWAPT, or relevant vulnerability management certifications; experience with scripting and API integration; and testing web applications, APIs, and cloud environments.

🏝️ Benefits

• A comprehensive benefits package is available.