Accountabilities

As Senior Engineer, Exposure & Vulnerability Management, you will own the technical strategy and implementation of continuous exposure management capabilities, ensuring vulnerabilities are identified, prioritized, and resolved according to business risk. Your responsibilities will include:

Design and deploy AI-powered multi-agent systems that manage exposures from discovery through verified remediation.

Build automated workflows that analyze vulnerabilities externally, map internal dependencies, generate patches or Infrastructure-as-Code updates, and validate remediation outcomes.

Implement appropriate approval gates, audit trails, and rollback mechanisms to ensure automated changes receive risk-based oversight.

Develop risk-based prioritization engines that move beyond static CVSS scores by incorporating real-time reachability, attack-path context, business criticality, and active exploit intelligence.

Implement automated verification to distinguish theoretical vulnerabilities from conditions that are actively exploitable, reducing alert noise and helping engineering teams focus on critical risks.

Drive the Continuous Threat Exposure Management (CTEM) strategy, transitioning from periodic scans to continuous security monitoring across products, platforms, cloud and on-premise infrastructure, and corporate applications.

Assess existing exposure and vulnerability management capabilities and redesign the program to support business objectives and a broader zero-trust security approach.

Architect cloud-native discovery, asset inventory, and remediation workflows, integrating them with ticketing systems, CI/CD pipelines, and configuration management tools.

Partner with Engineering and IT to embed secure-by-default practices into application development, deployment, and patching processes.

Establish risk-based remediation timelines that reflect the severity and business impact of each exposure.

Define and monitor security KPIs, KCIs, and KRIs, including mean time to remediate, exploitable exposure backlog, and critical asset coverage.

Collaborate with relevant teams to design and maintain vulnerability and exposure controls that support regulatory and compliance requirements, including SOC 2.

Continuously improve security processes through automation, measurable performance indicators, and cross-functional collaboration.

Requirements

The ideal candidate is an experienced security engineer with a strong background in vulnerability and exposure management, cloud security, and automation. You should combine strategic program ownership with hands-on technical expertise, particularly in AI-driven security workflows and risk-based remediation. Key qualifications include:

Bachelor's or Master's degree in Computer Science, Information Security, or a related field, or equivalent practical experience.

At least 7 years of experience in vulnerability management, exposure management, or related information security domains.

Demonstrated experience leading large-scale security programs from strategy through execution in cloud-first and hybrid environments.

Deep understanding of security principles and proven ability to translate vulnerability data into prioritized, assigned, and verified remediation actions.

Hands-on experience building or deploying AI/LLM-based agents or multi-agent systems for security or engineering workflows, including orchestration, tool usage, and evaluation.

Working knowledge of approval workflows, audit logging, and rollback controls for automated remediation, including an understanding of the risks associated with agent-driven changes.

Proficiency in one or more programming languages, such as Python, Go, or Java, with strong scripting and automation capabilities.

Advanced experience with vulnerability and exposure management platforms such as Tenable, Qualys, Rapid7, or equivalent solutions.

Familiarity with CTEM, attack surface management, and attack-path analysis tools and methodologies.

Strong command of risk-based vulnerability prioritization frameworks and intelligence sources, including CVSS, EPSS, CISA KEV, reachability analysis, and threat intelligence feeds.

How Jobgether works

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1