Vulnerability Management Engineer

This is a fully remote position, open to applicants in Colombia, +2 more countries.

📋 Description

• Lead a risk-focused approach to vulnerability and exposure management across infrastructure, applications, cloud services, endpoints, and software dependencies.

• Integrate threat intelligence and vulnerability insights with asset inventory, software and system configurations, application testing, network exposure, ownership, and business importance.

• Evaluate exploitability and reachability instead of solely depending on vulnerability severity.

• Factor in exploit prediction, known exploitation, open-source threat intelligence, adversary behavior, and environmental context when setting priorities.

• Ascertain if exposure necessitates immediate incident response or remediation according to defined operational objectives.

• Leverage AI-driven workflows to process and correlate vulnerability intelligence with the organization's technology setup while independently confirming findings.

• Collaborate with the Red Team to validate the practical exploitability of critical vulnerabilities.

• Identify compensating controls such as configuration adjustments, access limitations, segmentation, or filtering when immediate patching is not feasible.

• Streamline processes for vulnerability ingestion, analysis, prioritization, remediation tracking, mitigation, and verification where applicable.

⛳️ Requirements

• Proven experience in enterprise vulnerability or exposure management.

• In-depth knowledge of infrastructure, applications, cloud technologies, containers, networking, and software dependencies.

• Proficient in interpreting vulnerability intelligence and evaluating practical exploitability.

• Familiarity with risk-based prioritization methods, including CVSS, exploit prediction, known-exploitation intelligence, and environmental context.

• Experience in correlating vulnerability, asset, configuration, SAST, DAST, SCA, endpoint, or related security data.

• Background in scripting, automation, or data analysis.

• Strong understanding of OWASP Top 10, MITRE ATT&CK, MITRE D3FEND, and STRIDE frameworks.

• Knowledge of OWASP Top 10 for LLM, OWASP Top 10 for Agentic Applications, MITRE ATLAS, and MAESTRO.

• Familiarity with continuous exposure management, attack-path analysis, AI-assisted analysis, or automated mitigation is advantageous.

🏝️ Benefits

• Commitment to being an Equal Opportunity Employer.

• Values of diversity, equity, and inclusion.

• An inclusive workplace where employees are encouraged to express their authentic selves and perform at their best.