Vulnerability & Attack Surface Management Analyst II

About OpenLoop OpenLoop was co-founded by CEO, Dr. Jon Lensing, and COO, Christian Williams, with the vision to bring care anywhere. Our telehealth support solutions are thoughtfully designed to streamline and simplify go-to-market care delivery for companies offering meaningful virtual support to patients across an expansive array of specialties, in all 50 states. About the Role OpenLoop’s mission is to bring care anywhere by powering telehealth solutions at scale. Security Operations at OpenLoop protects patient data, clinical operations, and the systems our partners build on. We handle PHI, we’re subject to HIPAA, and care delivery depends on our systems working. We’re hiring a Vulnerability & Attack Surface Management Analyst II. Nobody at OpenLoop works on vulnerability management or attack surface management full-time today, so you’ll be the first. You’ll report to the Director of Information Security, who sets strategy and priorities for both programs. You’ll carry out that plan, and we expect you to tell us when the findings suggest the priorities should change. Some context on where things stand. Our cloud inventory has grown about five times over this year and more than doubled in the last two months. We deployed Wiz eight months ago, and it’s finding far more risk than we currently have people to work. Vulnerability management gets squeezed in around other work, and attack surface management has barely started. We’re also rolling out a platform that lets internal teams publish their own applications, which will grow our external footprint faster than anything else this year. The program is early. You’ll help build it, with a direction already set. You’ll take a very large set of findings and narrow it to what matters using the risk model we’re putting in place, get fixes shipped through engineering teams across the company, and run attack surface discovery on a regular schedule instead of only when a client asks. What this role is not: forwarding scanner reports to engineering. You own the fix through verification.

It’s also not incident response or forensics (you’ll work with our IR team, but your focus is exposure and remediation), not a GRC role (you’ll help with audits and client reviews, but the day-to-day work is operational), and not a tool evaluation role. The platforms are in place, and the job is getting results from them. What You’ll Do - Run the vulnerability lifecycle day to day: discovery, validation, prioritization, remediation tracking, verification, and reporting across cloud workloads, containers, code repositories, and endpoints. - Prioritize by actual risk, not raw CVSS. Apply and improve our risk model, which weighs internet exposure, exploitability (CISA KEV, EPSS), asset criticality, and data sensitivity. When the model needs to change, bring the evidence. When something is being deprioritized, make that visible so the decision is made on purpose. - Build a reliable asset inventory. Combine cloud, endpoint, and SaaS inventory into one view, with a named owner for every asset that matters. Most assets don’t have an owner today, so this is your first and most important deliverable. After that, run external discovery on a set schedule to find what we have exposed to the internet, including things nobody told us about. - Drive remediation. Get fixes done through Engineering, IT, and Platform teams. Write tickets people can act on, agree on realistic timelines, escalate to the Director when you’re blocked, and confirm the fix is in place. - Fix problems at the source and automate repetitive work. Roll out hardened base images and dependency baselines so a single upstream change closes thousands of findings. We’ve piloted this and it works, and you’ll lead the broader rollout. Connect scanner and CNAPP APIs to ticketing and reporting. If you find yourself building the same report by hand twice, automate it. - Own web application security.