SummaryWe are seeking a Vulnerability Management Engineer to support and mature an enterprise Vulnerability Management program. This hands-on role owns vulnerabilities across the full lifecycle-from identification and technical triage through prioritization, remediation coordination, validation, and closure. The ideal candidate combines strong vulnerability platform expertise with the ability to translate technical findings into clear, risk-based actions for infrastructure, application, cloud, security, and business stakeholders.
Key Responsibilities- Own vulnerability findings from identification and triage through remediation, validation, and closure.
- Analyze scanner results and contextual risk data, including CVE, CVSS, CISA KEV, EPSS, vendor advisories, threat intelligence, exploitability, exposure, and business impact.
- Investigate findings to determine applicability, affected technology, root cause, severity, ownership, and organizational risk.
- Identify false positives, duplicate findings, accepted risks, compensating controls, and exceptions requiring additional validation or documentation.
- Identify responsible infrastructure, application, cloud, system, or business owners and communicate remediation requirements clearly.
- Track findings against remediation timelines and SLAs; follow up, escalate overdue or high-risk vulnerabilities, and support emergency response to critical or actively exploited threats.
- Provide remediation teams with technical context, vendor guidance, mitigation options, and practical recommendations.
- Validate remediation through rescanning, targeted testing, manual review, or supporting evidence and ensure accurate disposition in the vulnerability platform.
- Operate and optimize enterprise vulnerability management platforms such as Qualys VMDR, Tenable, Rapid7, or equivalent technologies.
- Maintain searches, dashboards, asset groups, tags, reports, authentication, agents, scan coverage, and data quality.
- Develop risk-based metrics and reporting on vulnerability trends, aging, recurrence, remediation performance, and systemic weaknesses.
- Partner with Asset Management, Infrastructure, Cloud, Application Security, Security Operations, Threat Intelligence, Governance, and business teams to improve coverage, ownership, and remediation outcomes.
- Maintain procedures, playbooks, and program documentation; identify opportunities to automate repeatable workflows and improve program maturity.
- Provide technical guidance and mentorship to junior team members.
Requirements- Bachelor's degree in Information Technology, Cybersecurity, Computer Science, Business, or a related field (or equivalent experience).
- 4-8 years of hands-on experience in vulnerability management, security engineering, infrastructure security, or a closely related cybersecurity discipline.
- Demonstrated ownership of the complete vulnerability lifecycle: identification, triage, risk evaluation, ownership determination, stakeholder outreach, remediation tracking, escalation, validation, and closure.
- Strong hands-on experience with Qualys VMDR, Tenable, Rapid7, or an equivalent enterprise vulnerability management platform.
- Strong knowledge of CVE, CVSS, CPE, exploitability, severity, compensating controls, remediation, mitigation, false positives, risk acceptance, and vulnerability prioritization.
- Ability to independently interpret scanner results, investigate findings, assess practical risk, and determine appropriate remediation actions.
- Experience managing high volumes of vulnerability data in a large or complex enterprise environment.
- Experience identifying system or application owners and driving remediation across multiple technical teams.
- Experience validating remediation through rescanning, technical testing, manual review, or evidence assessment.
- Strong working knowledge of Windows, Linux, networking, servers, databases, middleware, virtualization, and cloud environments.
- Understanding of remediation methods including patching, configuration changes, software upgrades, compensating controls, and service removal.
- Strong analytical, troubleshooting, documentation, stakeholder communication, prioritization, and organizational skills.
- Ability to work independently while managing multiple remediation efforts and collaborating across technical and business teams.
Preferred Qualifications - Advanced Qualys VMDR experience, including vulnerability detection, asset inventory, tagging, dashboards, reporting, authentication, and agent-based assessments.
- Experience with attack surface management or external exposure management technologies.
- Experience supporting AWS, Microsoft Azure, or Google Cloud Platform environments.
- Experience integrating vulnerability platforms with ticketing, SIEM, SOAR, CMDB, asset management, or reporting solutions.
- Experience with Jira, ServiceNow, Splunk, Microsoft Sentinel, Power BI, or similar enterprise platforms.
- Familiarity with CISA KEV, EPSS, vendor threat intelligence, and exploit intelligence sources.
- Scripting or automation experience using Python, PowerShell, APIs, or similar technologies.
- Experience with remediation SLAs, risk exceptions, governance processes, security frameworks, or regulatory requirements.
- Relevant certifications such as Security+, CISSP, GIAC, Qualys certifications, or equivalent industry credentials.
