Vulnerability Manager

This is a fully remote position, open to applicants in Canada, +1 more country.

📋 Description

• Design and manage the complete product vulnerability management process, which encompasses intake, triage, risk assessment, assignment, SLA tracking, exception handling, and closure verification.

• Take ownership of vulnerability management for FedRAMP 20x, ensuring continuous monitoring, machine-readable evidence, Key Security Indicator reporting, and POA&M lifecycle management.

• Establish vulnerability management practices for new products and services, including scan coverage, onboarding, SLAs, and reporting.

• Evaluate and prioritize vulnerability risk based on exploitability, exposure, asset criticality, and compensating controls.

• Facilitate remediation efforts with product engineering teams, escalate overdue Critical and High findings, and document time-bound risk acceptances.

• Automate processes related to triage, deduplication, enrichment, summarization, reporting, workflow, and evidence collection using scripting, workflow tools, and AI-assisted analysis.

• Define requirements for integrations involving scanners, ticketing systems, asset inventory, and dashboards; collaborate with Security Engineering during delivery and validate results.

• Manage program metrics including SLA attainment, mean time to remediate, vulnerability aging, backlog trends, scan and asset coverage, and exception volume.

• Present metrics to security and engineering leadership on a regular basis.

• Maintain up-to-date visibility into critical product exposure and outstanding vulnerabilities.

• Lead rapid response initiatives for actively exploited and zero-day vulnerabilities, including exposure assessment, mitigation tracking, and communication with stakeholders.

⛳️ Requirements

• Over 5 years of experience in vulnerability management, product security, or security operations, with direct responsibility for a vulnerability management process.

• Proven experience in designing and managing vulnerability management processes within a regulated or audited environment, maintaining them through assessment cycles.

• Familiarity with FedRAMP and NIST SP 800-53, covering aspects such as vulnerability scanning, flaw remediation, continuous monitoring, configuration management, and POA&M management.

• Hands-on experience with enterprise vulnerability and exposure management platforms, cloud security posture tools, container scanning, and software composition analysis.

• Practical automation skills, including proficiency in Python or equivalent scripting, workflow and reporting tools, and AI assistance.

• Capability to write technical requirements and collaborate with security engineering throughout the design, delivery, and acceptance phases.

• Understanding of CVSS, CISA Known Exploited Vulnerabilities (KEV), EPSS, and risk-based prioritization.

• Familiarity with cloud services, preferably AWS, as well as containers, Kubernetes, CI/CD, web applications, and APIs.

• Ability to drive remediation efforts across engineering teams without direct authority.

• Strong written and verbal communication skills to engage with engineers, executives, auditors, and customers.

• Must be based in North America.

🏝️ Benefits

• Flexibility, trust, and a culture of continual learning.

• Comprehensive employee care and support.

• Commitment to diversity and inclusion.