The Vulnerability Management Engineer is responsible for administering and enhancing the organization's vulnerability management program by identifying, assessing, prioritizing, and driving remediation of security vulnerabilities across IT systems. This role minimizes risk and threat exposure by identifying, prioritizing, and remediating vulnerabilities in accordance with our security policies. Technical skills, attention to detail, and proactive approach will be essential in safeguarding our information technology infrastructure.
This position can be remote with occasional travel required for business meetings and company events as needed.
Remote hires will be required to travel to our headquarters in Ankeny, IA (company paid) their first few days for new hire orientation, training, and onboarding.At this time, we are NOT considering applicants that require immigration sponsorship (additional work authorization or permanent work authorization) now or in the future to work in the United States. This includes, but IS NOT LIMITED TO: F1-OPT, F1-CPT, H-1B, TN, L-1, J-1, etc.Salary range: $89,000-94,000% plus 10% bonus target
Benefits
Our employees enjoy a generous package of benefits that we are thrilled to provide, and feel is part of what makes us different as an employer. We value our team members, and this is one way we can show it.
Benefits include:
-PTO, holiday pay and holiday of choice
-401(k) match
-Life insurance
-Short-term disability
-Health, dental and vision insurance
-Maternity/paternity leave
-Health savings account (HSA)
-Flex spending accounts (FSA) - health and dependent
Position Responsibilities may include, but not limited to:- Manage internal and external vulnerability scanning, maintain coverage of in-scope assets, and validate findings to support accurate remediation
- Assess and prioritize vulnerabilities based on severity, exploitability, asset exposure, and business impact
- Monitor newly disclosed vulnerabilities, active exploitation, and emerging threats. Coordinate timely remediation or appropriate compensating controls
- Manage endpoint and server patching, coordinating with asset owners to remediate vulnerabilities within established timelines
- Own third-party application patch management using Automox, Intune, Patch My PC Cloud, and scripting, including deployment validation and coordination of testing and change approvals
- Collaborate with infrastructure and software engineering teams to assign remediation ownership, track progress against established deadlines, escalate overdue findings, and validate remediation through rescanning
- Where appropriate, directly remediate vulnerabilities using Intune, Active Directory Group Policy, Automox, and PowerShell scripting, following established testing and change-management processes.
- Report vulnerability trends, remediation progress, overdue findings, scan coverage, and material risks to IT leadership
- Own and continuously improve the vulnerability management lifecycle, including scanning, prioritization, remediation tracking, validation, and exception documentation
- Participate in the ongoing on-call rotation, triaging and investigating security alerts, responding to incidents, and coordinating escalation and remediation as needed
Required Skills and Experience- 1-3 years of experience in a similar infrastructure or security role
- Working knowledge of Intune, Automox, Active Directory Group Policy, and PowerShell scripting
- Hands-on experience with patch management, deployment, and reporting
- Good working knowledge of current IT risks and experience implementing security solutions
- Experience administering and securing Windows Server, Windows 10 and 11, and macOS
- Effective troubleshooting skills and ability to solve complex problems
- Strong attention to detail and analytical skills
- Excellent interpersonal and communication skills
- Ability to work under pressure and meet tight deadlines
Preferred Skills and Experience- Relevant certifications such as CompTIA Security+, CompTIA Network+, or Microsoft 365 Certified: Endpoint Administrator Associate (MD-102) are preferred but not required; equivalent hands-on infrastructure or security experience is also valued
- Familiarity with software development lifecycles and application vulnerability remediation, including collaboration with development teams
- Experience validating vulnerability findings, confirming remediation, or integrating vulnerability management with patching and ticketing workflows
- Incident response experience; candidates without prior experience should demonstrate a willingness to learn and develop these skills through training and hands-on participation
- Experience leveraging artificial intelligence to aid in technical tasks.
- Exposure to cloud security
Physical Requirements- Repetitive motions that include the wrists, hands and/or fingers
- Sedentary work that primarily involves sitting, remaining in a stationary position for prolonged periods
- Visual perception to perform job including peripheral vision, depth perception, and the ability to adjust focus
