Staff Vulnerability Management Analyst- AI Automation Security Researcher

Role Description

We are seeking a Vulnerability Management engineer to join our team as both a vulnerability management practitioner and an automation builder. This role combines traditional vulnerability analysis and remediation coordination with a strong emphasis on developing AI-powered tools and automations that scale the team's effectiveness. You will analyze vulnerabilities across infrastructure, cloud, and application layers, coordinate remediation with engineering teams, and build automation that makes the entire program faster and smarter.

Key Responsibilities

• Vulnerability Discovery & Security Research (40%)
  • Conduct deep-dive source code audits of UKG products (Java, .NET, Python, JavaScript) to discover novel vulnerabilities.
  • Develop working proof-of-concept exploits that demonstrate real impact.
  • Perform variant analysis to systematically search the entire codebase for every instance of the same root cause pattern.
  • Triage and validate findings from automated scanners (SAST, DAST, SCA).
  • Investigate and reproduce externally reported vulnerabilities to assess actual exploitability in UKG's environment.
  • Collaborate with engineering teams on remediation.
• AI-Powered Vulnerability Automation (35%)
  • Build AI-assisted vulnerability discovery tools using automation.
  • Develop autonomous security scanning agents.
  • Create AI-powered remediation tools.
  • Build automated vulnerability lifecycle pipelines.
  • Contribute to the team's shared automation repositories.
• Vulnerability Management & Remediation Driving (20%)
  • Own vulnerability remediation outcomes for assigned product areas.
  • Produce clear, actionable vulnerability reports.
  • Drive mean time to remediate (MTTR) down through better automation.
  • Support vulnerability management program metrics and dashboards.
  • Support compliance-driven vulnerability management requirements.
• Research & Knowledge Sharing (5%)
  • Publish internal/external research on novel vulnerability classes.
  • Stay current on emerging vulnerability classes and exploitation techniques.
  • Mentor other team members on vulnerability research methodology.

Qualifications

• 7+ years of hands-on experience in vulnerability research, application security, or penetration testing.
• Demonstrated ability to read and audit source code in at least two of: Java, C#/.NET, Python, JavaScript/TypeScript, Go, C/C++.
• Experience developing working proof-of-concept exploits.
• Strong proficiency in Python for building security tools.
• Experience with AI/ML tools for security.
• Deep understanding of common vulnerability classes.
• Experience with vulnerability management programs.
• Ability to work directly with development teams.
• Excellent written communication.
• Bachelor's degree in Computer Science, Cybersecurity, or equivalent experience.

Preferred Qualifications

• Published CVEs, security advisories, or bug bounty findings.
• Experience in SaaS/multi-tenant environments processing sensitive data.
• Familiarity with SAST/DAST/SCA tooling.
• Experience with cloud security assessment.
• Familiarity with FedRAMP, NIST SP 800-53, or federal compliance frameworks.
• Security certifications that demonstrate hands-on skill.
• Conference presentations, published research, or open-source security tool contributions.
• Experience with reverse engineering, binary analysis, or firmware security.

Benefits

• Competitive base salary.
• Annual bonus.
• Equity.
• Full medical/dental/vision.
• 401(k) match.
• Unlimited PTO.
• Professional development budget.
• Remote work eligibility anywhere in the US.

Company Description

UKG is the Workforce Operating Platform that puts workforce understanding to work. With the world's largest collection of workforce insights, and people-first AI, our ability to reveal unseen ways to build trust, amplify productivity, and empower talent, is unmatched.