Senior Engineer, Exposure & Vulnerability Management

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior Engineer, Exposure & Vulnerability Management based in the United States.

The Senior Engineer, Exposure & Vulnerability Management will lead the evolution of enterprise security from periodic vulnerability scanning to continuous, risk-driven exposure management. In this role, you will design intelligent, automated systems that identify, prioritize, remediate, and verify security exposures across cloud, on-premise infrastructure, applications, and corporate environments. You will leverage AI agents, automation, and real-time threat intelligence to distinguish genuinely exploitable vulnerabilities from lower-risk findings. Working closely with Engineering, IT, and Information Security teams, you will embed secure-by-default practices into development and operational workflows. You will also strengthen governance through approval controls, audit trails, measurable security outcomes, and compliance-focused processes. This is an opportunity to shape a proactive security strategy while applying advanced automation to protect complex technology environments.

As Senior Engineer, Exposure & Vulnerability Management, you will own the technical strategy and implementation of continuous exposure management capabilities, ensuring vulnerabilities are identified, prioritized, and resolved according to business risk. Your responsibilities will include:

• Design and deploy AI-powered multi-agent systems that manage exposures from discovery through verified remediation.

• Build automated workflows that analyze vulnerabilities externally, map internal dependencies, generate patches or Infrastructure-as-Code updates, and validate remediation outcomes.

• Implement appropriate approval gates, audit trails, and rollback mechanisms to ensure automated changes receive risk-based oversight.

• Develop risk-based prioritization engines that move beyond static CVSS scores by incorporating real-time reachability, attack-path context, business criticality, and active exploit intelligence.

• Implement automated verification to distinguish theoretical vulnerabilities from conditions that are actively exploitable, reducing alert noise and helping engineering teams focus on critical risks.

• Drive the Continuous Threat Exposure Management (CTEM) strategy, transitioning from periodic scans to continuous security monitoring across products, platforms, cloud and on-premise infrastructure, and corporate applications.

• Assess existing exposure and vulnerability management capabilities and redesign the program to support business objectives and a broader zero-trust security approach.

• Architect cloud-native discovery, asset inventory, and remediation workflows, integrating them with ticketing systems, CI/CD pipelines, and configuration management tools.

• Partner with Engineering and IT to embed secure-by-default practices into application development, deployment, and patching processes.

• Establish risk-based remediation timelines that reflect the severity and business impact of each exposure.

• Define and monitor security KPIs, KCIs, and KRIs, including mean time to remediate, exploitable exposure backlog, and critical asset coverage.

• Collaborate with relevant teams to design and maintain vulnerability and exposure controls that support regulatory and compliance requirements, including SOC 2.

• Continuously improve security processes through automation, measurable performance indicators, and cross-functional collaboration.

Requirements

The ideal candidate is an experienced security engineer with a strong background in vulnerability and exposure management, cloud security, and automation. You should combine strategic program ownership with hands-on technical expertise, particularly in AI-driven security workflows and risk-based remediation. Key qualifications include:

• Bachelor's or Master's degree in Computer Science, Information Security, or a related field, or equivalent practical experience.

• At least 7 years of experience in vulnerability management, exposure management, or related information security domains.

• Demonstrated experience leading large-scale security programs from strategy through execution in cloud-first and hybrid environments.

• Deep understanding of security principles and proven ability to translate vulnerability data into prioritized, assigned, and verified remediation actions.

• Hands-on experience building or deploying AI/LLM-based agents or multi-agent systems for security or engineering workflows, including orchestration, tool usage, and evaluation.

• Working knowledge of approval workflows, audit logging, and rollback controls for automated remediation, including an understanding of the risks associated with agent-driven changes.

• Proficiency in one or more programming languages, such as Python, Go, or Java, with strong scripting and automation capabilities.

• Advanced experience with vulnerability and exposure management platforms such as Tenable, Qualys, Rapid7, or equivalent solutions.

• Familiarity with CTEM, attack surface management, and attack-path analysis tools and methodologies.

• Strong command of risk-based vulnerability prioritization frameworks and intelligence sources, including CVSS, EPSS, CISA KEV, reachability analysis, and threat intelligence feeds.

• Experience with cloud platforms such as AWS, Azure, or GCP.

• Knowledge of container and Kubernetes security, as well as Infrastructure-as-Code tools such as Terraform and CloudFormation.

• Experience with CI/CD pipelines, SCA/SAST tools, and software supply chain security practices, including SBOMs and dependency mapping.

• Strong understanding of operating systems, including UNIX/Linux, macOS, and Windows, as well as networking and database management systems.

• Experience with security risk management and aligning technical solutions with organizational risk tolerance and compliance requirements, such as SOC 2 or GxP.

• Strong analytical, problem-solving, and communication skills, with the ability to collaborate across technical teams and translate security risks into actionable priorities.

Preferred Qualifications:

• Relevant security certifications such as CISSP, OSCP, or GWAPT.

• Experience designing and implementing continuous exposure management programs in complex enterprise environments.

• Familiarity with regulated technology or life sciences environments and their security and compliance requirements.

Benefits

• Base salary: $134,200–$180,600 USD annually, depending on skills, experience, and qualifications.

• Eligibility for an annual performance-based bonus.

• Equity compensation.

• Comprehensive healthcare benefits.

• Flexible Spending Account (FSA).

• Flexible work arrangements.

• Flexible time off.

• Parental leave.

• Opportunity to work on advanced AI-driven security technologies and enterprise-scale automation initiatives.

• Collaboration with a growing Information Security team and cross-functional engineering partners.

How Jobgether works:

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1