Senior Cybersecurity Engineer — Vulnerability and Threat Management

Senior Cybersecurity Engineer — Vulnerability and Threat Management Dartmouth College has a Tobacco-Free Policy. Smoking and the use of tobacco-based products (including smokeless tobacco) are prohibited in all facilities, grounds, vehicles or other areas owned, operated or occupied by Dartmouth College with no exceptions. For details, please see our policy. Position Purpose Dartmouth College seeks a Senior Cybersecurity Engineer to own and mature the institution’s vulnerability management program, integrate threat intelligence into vulnerability prioritization and defensive operations, and leverage AI to accelerate both disciplines. This role is responsible for the full vulnerability management lifecycle—from asset discovery and scanning through risk‑rated prioritization, remediation coordination, and executive reporting—enriched by threat intelligence that ties vulnerability data to real‑world adversary activity. You will operate across a complex environment that includes academic and administrative systems, research computing infrastructure, and a hybrid cloud footprint. What You’ll Join Dartmouth’s cybersecurity program is in an active investment and maturation phase under new CISO leadership. You won’t be slotting into a static operation—you’ll be helping build it. The team values technical depth, clear communication, and pragmatic risk management over checkbox compliance. You’ll work with modern tooling, have direct input on how AI transforms vulnerability and threat intelligence operations, and sit at the intersection of technical execution and institutional risk strategy. The mission matters: protecting a world‑class research university, its students, its faculty, and the sensitive data entrusted to it. Required Qualifications Bachelor’s degree in computer science, cybersecurity, information systems, or a related field— or equivalent professional experience. 5+ years of hands‑on cybersecurity engineering experience, with at least 3 years directly managing or operating a vulnerability management program. Experience building vulnerability management or threat intelligence programs from early maturity. Deep working knowledge of enterprise vulnerability scanning platforms (e.g., Tenable, Qualys, Rapid7). Experience consuming and operationalizing threat intelligence from commercial platforms, ISACs, and open‑source feeds to inform defensive operations. Experience with developing vulnerability management API integrations and automations with other cybersecurity technologies. Demonstrated ability to drive remediation with stakeholders outside your direct reporting chain. Solid understanding of CVSS scoring, EPSS, KEV catalog usage, and risk‑based prioritization beyond “patch everything critical.” Strong written and verbal communication skills. Preferred Qualifications Experience in higher education, healthcare, or other environments with decentralized IT governance and federated system ownership. Working knowledge of industry leading EDR, SIEM and Log Management platforms. Hands‑on experience applying AI/ML tools to vulnerability management or threat intelligence workflows—including generative AI for analysis acceleration, AI‑driven prioritization models, or automated enrichment pipelines. Familiarity with AI‑specific threat vectors (prompt injection, model manipulation, data exfiltration via AI tooling) and their implications for vulnerability management programs. Familiarity with compliance frameworks relevant to research universities: CMMC, NIST 800‑171, HIPAA, GLBA, FERPA, ITAR/EAR. Experience with threat intelligence platforms (TIPs), STIX/TAXII, and MITRE ATT&CK framework mapping. Experience with external attack surface management (EASM) and cloud‑native vulnerability assessment. Relevant certifications: GEVA, GCIH, GCTI, CTIA, CISSP, or equivalent. Responsibilities Vulnerability Management Program Ownership Percentage of time: 20% Own end‑to‑end vulnerability management lifecycle: asset inventory, scanning, prioritization, remediation tracking, exception management, and metrics reporting. Operate and tune vulnerability scanning infrastructure across on‑premises, cloud, and hybrid environments. Develop and maintain risk‑based prioritization frameworks that account for asset criticality, threat intelligence context, exploitability (EPSS, KEV), and regulatory exposure. Evaluate and operationalize AI‑driven vulnerability prioritization and automated triage capabilities within scanning and remediation workflows, reducing manual effort while maintaining appropriate human oversight. Develop and enforce a vulnerability management standard including SLAs for remediation timelines by severity, with graduated escalation paths appropriate for a higher education environment. Threat Intelligence & Analysis Percentage of time: 20% Consume, analyze, and operationalize threat intelligence and open‑source feeds (CISA KEV, sector ISACs, higher education–specific sources) to inform vulnerability prioritization and defensive posture. Produce threat intelligence summaries for the CISO and institutional leadership, translating adversary activity into actionable risk context. Correlate vulnerability data with threat intelligence to identify exposures actively targeted by threat actors, ensuring remediation efforts focus on real‑world exploitability rather than CVSS scores alone. Leverage generative AI platforms to accelerate threat intelligence analysis, including rapid synthesis of advisories, campaign reporting, and indicator enrichment. Monitor the evolving threat landscape for emerging vulnerabilities, zero‑day disclosures, and adversary TTPs relevant to Dartmouth’s regulatory and research profile. Contribute threat‑informed context to incident response, security architecture reviews, and risk assessments across the cybersecurity team. Cross‑Functional Remediation Coordination Percentage of time: 20% Drive remediation outcomes with system administrators, application owners, research computing teams, and third‑party vendors. Develop strong working relationships with decentralized IT groups across academic departments and research labs to gain cooperation without mandate authority. Coordinate with the endpoint management team and infrastructure teams to validate remediation and compensating controls. Reporting & Governance Percentage of time: 20% Produce recurring vulnerability posture and threat landscape reports for the CISO, CIO, and institutional leadership, translating scan output and intelligence into risk narratives, trend analysis, and remediation progress metrics. Maintain dashboards that provide real‑time visibility into vulnerability posture by business unit, asset class, and regulatory domain. Support audit and compliance evidence collection. Brief institutional governance bodies as needed on vulnerability trends, threat actor activity, and residual risk. Tooling & Integration Enhancements Percentage of time: 20% Integrate vulnerability management data with cybersecurity tooling to enable correlated, threat‑informed prioritization. Evaluate and recommend tooling enhancements, including external attack surface management (EASM), container/cloud‑native scanning, and AI‑augmented vulnerability analytics. Develop and maintain operational runbooks for scanning operations, emergency out‑of‑cycle scanning (zero‑day response), threat intelligence workflows, and integration with the incident response process. Contribute to the broader cybersecurity engineering function, including participation in incident response, threat hunting, and security architecture reviews as needed. Equal Opportunity Employer Dartmouth College is an equal‑opportunity employer under federal law. We prohibit discrimination on the basis of race, color, religion, sex, age, national origin, sexual orientation, gender identity or expression, disability, veteran status, marital status, or any other legally protected status. Applications are welcome from all. Employment Eligibility Employment in this position is contingent upon consent to and successful completion of a pre‑employment background check, which may include a criminal background check, reference checks, verification of work history, conduct review, and verification of any required academic credentials, licenses, and/or certifications, with results acceptable to Dartmouth College. A criminal conviction will not automatically disqualify an applicant from employment. Background check information will be used in a confidential, non‑discriminatory manner consistent with state and federal law. #J-18808-Ljbffr Dartmouth College