Senior Engineer, Exposure & Vulnerability Management

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior Engineer, Exposure & Vulnerability Management based in the United States.

The Senior Engineer, Exposure & Vulnerability Management will lead the evolution of enterprise security from periodic vulnerability scanning to continuous, risk-driven exposure management. In this role, you will design intelligent, automated systems that identify, prioritize, remediate, and verify security exposures across cloud, on-premise infrastructure, applications, and corporate environments. You will leverage AI agents, automation, and real-time threat intelligence to distinguish genuinely exploitable vulnerabilities from lower-risk findings. Working closely with Engineering, IT, and Information Security teams, you will embed secure-by-default practices into development and operational workflows. You will also strengthen governance through approval controls, audit trails, measurable security outcomes, and compliance-focused processes. This is an opportunity to shape a proactive security strategy while applying advanced automation to protect complex technology environments.

Accountabilities

As Senior Engineer, Exposure & Vulnerability Management, you will own the technical strategy and implementation of continuous exposure management capabilities, ensuring vulnerabilities are identified, prioritized, and resolved according to business risk. Your responsibilities will include:

• Design and deploy AI-powered multi-agent systems that manage exposures from discovery through verified remediation.

• Build automated workflows that analyze vulnerabilities externally, map internal dependencies, generate patches or Infrastructure-as-Code updates, and validate remediation outcomes.

• Implement appropriate approval gates, audit trails, and rollback mechanisms to ensure automated changes receive risk-based oversight.

• Develop risk-based prioritization engines that move beyond static CVSS scores by incorporating real-time reachability, attack-path context, business criticality, and active exploit intelligence.

• Implement automated verification to distinguish theoretical vulnerabilities from conditions that are actively exploitable, reducing alert noise and helping engineering teams focus on critical risks.

• Drive the Continuous Threat Exposure Management (CTEM) strategy, transitioning from periodic scans to continuous security monitoring across products, platforms, cloud and on-premise infrastructure, and corporate applications.

• Assess existing exposure and vulnerability management capabilities and redesign the program to support business objectives and a broader zero-trust security approach.

• Architect cloud-native discovery, asset inventory, and remediation workflows, integrating them with ticketing systems, CI/CD pipelines, and configuration management tools.

• Partner with Engineering and IT to embed secure-by-default practices into application development, deployment, and patching processes.

• Establish risk-based remediation timelines that reflect the severity and business impact of each exposure.

• Define and monitor security KPIs, KCIs, and KRIs, including mean time to remediate, exploitable exposure backlog, and critical asset coverage.

• Collaborate with relevant teams to design and maintain vulnerability and exposure controls that support regulatory and compliance requirements, including SOC 2.

• Continuously improve security processes through automation, measurable performance indicators, and cross-functional collaboration.

Requirements

The ideal candidate is an experienced security engineer with a strong background in vulnerability and exposure management, cloud security, and automation. You should combine strategic program ownership with hands-on technical expertise, particularly in AI-driven security workflows and risk-based remediation. Key qualifications include:

• Bachelor's or Master's degree in Computer Science, Information Security, or a related field, or equivalent practical experience.

• At least 7 years of experience in vulnerability management, exposure management, or related information security domains.

• Demonstrated experience leading large-scale security programs from strategy through execution in cloud-first and hybrid environments.

• Deep understanding of security principles and proven ability to translate vulnerability data into prioritized, assigned, and verified remediation actions.

• Hands-on experience building or deploying AI/LLM-based agents or multi-agent systems for security or engineering workflows, including orchestration, tool usage, and evaluation.

• Working knowledge of approval workflows, audit logging, and rollback controls for automated remediation, including an understanding of the risks associated with agent-driven changes.

• Proficiency in one or more programming languages, such as Python, Go, or Java, with strong scripting and automation capabilities.

• Advanced experience with vulnerability and exposure management platforms such as Tenable, Qualys, Rapid7, or equivalent solutions.

• Familiarity with CTEM, attack surface management, and attack-path analysis tools and methodologies.

• Strong command of risk-based vulnerability prioritization frameworks and intelligence sources, including CVSS, EPSS, CISA KEV, reachability analysis, and threat intelligence feeds.

• Experience with cloud platforms such as AWS, Azure, or GCP.

• Knowledge of container and Kubernetes security, as well as Infrastructure-as-Code tools such as Terraform and CloudFormation.

• Experience with CI/CD pipelines, SCA/SAST tools, and software supply chain security practices, including SBOMs and dependency mapping.

• Strong understanding of operating systems, including UNIX/Linux, macOS, and Windows, as well as networking and database management systems.

• Experience with security risk management and aligning technical solutions with organizational risk tolerance and compliance requirements, such as SOC 2 or GxP.

• Strong analytical, problem-solving, and communication skills, with the ability to collaborate across technical teams and translate security risks into actionable priorities.

Preferred Qualifications:

• Relevant security certifications such as CISSP, OSCP, or GWAPT.

• Experience designing and implementing continuous exposure management programs in complex enterprise environments.

• Familiarity with regulated technology or life sciences environments and their security and compliance requirements.

Benefits

• Base salary: $134,200–$180,600 USD annually, depending on skills, experience, and qualifications.

• Eligibility for an annual performance-based bonus.

• Equity compensation.

• Comprehensive healthcare benefits.

• Flexible Spending Account (FSA).

• Flexible work arrangements.

• Flexible time off.

• Parental leave.

• Opportunity to work on advanced AI-driven security technologies and enterprise-scale automation initiatives.

• Collaboration with a growing Information Security team and cross-functional engineering partners.