Senior Engineer, Exposure & Vulnerability Management

Accountabilities: As Senior Engineer, Exposure & Vulnerability Management, you will own the technical strategy and implementation of continuous exposure management capabilities, ensuring vulnerabilities are identified, prioritized, and resolved according to business risk. Your responsibilities will include: Design and deploy AI-powered multi-agent systems that manage exposures from discovery through verified remediation. Build automated workflows that analyze vulnerabilities externally, map internal dependencies, generate patches or Infrastructure-as-Code updates, and validate remediation outcomes. Implement appropriate approval gates, audit trails, and rollback mechanisms to ensure automated changes receive risk-based oversight. Develop risk-based prioritization engines that move beyond static CVSS scores by incorporating real-time reachability, attack-path context, business criticality, and active exploit intelligence. Implement automated verification to distinguish theoretical vulnerabilities from conditions that are actively exploitable, reducing alert noise and helping engineering teams focus on critical risks. Drive the Continuous Threat Exposure Management (CTEM) strategy, transitioning from periodic scans to continuous security monitoring across products, platforms, cloud and on-premise infrastructure, and corporate applications. Assess existing exposure and vulnerability management capabilities and redesign the program to support business objectives and a broader zero-trust security approach. Architect cloud-native discovery, asset inventory, and remediation workflows, integrating them with ticketing systems, CI/CD pipelines, and configuration management tools. Partner with Engineering and IT to embed secure-by-default practices into application development, deployment, and patching processes. Establish risk-based remediation timelines that reflect the severity and business impact of each exposure. Define and monitor security KPIs, KCIs, and KRIs, including mean time to remediate, exploitable exposure backlog, and critical asset coverage. Collaborate with relevant teams to design and maintain vulnerability and exposure controls that support regulatory and compliance requirements, including SOC 2. Continuously improve security processes through automation, measurable performance indicators, and cross-functional collaboration. Requirements The ideal candidate is an experienced security engineer with a strong background in vulnerability and exposure management, cloud security, and automation. You should combine strategic program ownership with hands-on technical expertise, particularly in AI-driven security workflows and risk-based remediation. Key qualifications include: Bachelor's or Master's degree in Computer Science, Information Security, or a related field, or equivalent practical experience. At least 7 years of experience in vulnerability management, exposure management, or related information security domains. Demonstrated experience leading large-scale security programs from strategy through execution in cloud-first and hybrid environments. Deep understanding of security principles and proven ability to translate vulnerability data into prioritized, assigned, and verified remediation actions. Hands-on experience building or deploying AI/LLM-based agents or multi-agent systems for security or engineering workflows, including orchestration, tool usage, and evaluation. Working knowledge of approval workflows, audit logging, and rollback controls for automated remediation, including an understanding of the risks associated with agent-driven changes. Proficiency in one or more programming languages, such as Python, Go, or Java, with strong scripting and automation capabilities. Advanced experience with vulnerability and exposure management platforms such as Tenable, Qualys, Rapid7, or equivalent solutions. Familiarity with CTEM, attack surface management, and attack-path analysis tools and methodologies. Strong command of risk-based vulnerability prioritization frameworks and intelligence sources, including CVSS, EPSS, CISA KEV, reachability analysis, and threat intelligence feeds. Experience with cloud platforms such as AWS, Azure, or GCP. Knowledge of container and Kubernetes security, as well as Infrastructure-as-Code tools such as Terraform and CloudFormation. Experience with CI/CD pipelines, SCA/SAST tools, and software supply chain security practices, including SBOMs and dependency mapping. Strong understanding of operating systems, including UNIX/Linux, macOS, and Windows, as well as networking and database management systems. Experience with security risk management and aligning technical solutions with organizational risk tolerance and compliance requirements, such as SOC 2 or GxP. Strong analytical, problem-solving, and communication skills, with the ability to collaborate across technical teams and translate security risks into actionable priorities. Preferred Qualifications: Relevant security certifications such as CISSP, OSCP, or GWAPT. Experience designing and implementing continuous exposure management programs in complex enterprise environments. Familiarity with regulated technology or life sciences environments and their security and compliance requirements. Benefits Base salary: $134,200–$180,600 USD annually, depending on skills, experience, and qualifications. Eligibility for an annual performance-based bonus. Equity compensation. Comprehensive healthcare benefits. Flexible Spending Account (FSA). Flexible work arrangements. Flexible time off. Parental leave. Opportunity to work on advanced AI-driven security technologies and enterprise-scale automation initiatives. Collaboration with a growing Information Security team and cross-functional engineering partners.