Senior Vulnerability Management Engineer

Requirements:

• Bachelors degree in information technology, cybersecurity, computer science, business, or a related field, or equivalent experience.
• 4–8 years of hands-on experience in vulnerability management, security engineering, infrastructure security, or a related cybersecurity discipline.
• Experience owning the vulnerability lifecycle, from identification and triage through risk evaluation, remediation tracking, escalation, validation, and closure.
• Hands-on expertise with Qualys VMDR, Tenable, Rapid7, or an equivalent enterprise vulnerability management platform.
• Strong knowledge of CVE, CVSS, CPE, exploitability, severity, compensating controls, remediation, mitigation, false positives, risk acceptance, and vulnerability prioritization.
• Ability to interpret scanner results, investigate findings, assess practical risk, and recommend remediation actions independently.
• Experience managing large volumes of vulnerability data in a complex enterprise environment and coordinating remediation across technical teams.
• Experience validating remediation through rescanning, technical testing, manual review, or evidence assessment.
• Working knowledge of Windows, Linux, networking, servers, databases, middleware, virtualization, and cloud environments.
• Understanding of remediation approaches, including patching, configuration changes, software upgrades, compensating controls, and service removal.
• Strong analytical, troubleshooting, documentation, communication, prioritization, and organizational skills; able to manage multiple efforts independently and collaborate across technical and business teams.
• Preferred: Advanced Qualys VMDR skills, including vulnerability detection, asset inventory, tagging, dashboards, reporting, authentication, and agent-based assessments.
• Preferred: Experience with attack surface or external exposure management, AWS, Microsoft Azure, or Google Cloud Platform.
• Preferred: Experience integrating vulnerability platforms with ticketing, SIEM, SOAR, CMDB, asset management, or reporting tools.
• Preferred: Familiarity with Jira, ServiceNow, Splunk, Microsoft Sentinel, Power BI, or similar platforms; CISA KEV, EPSS, vendor threat intelligence, and exploit intelligence.
• Preferred: Scripting or automation experience with Python, PowerShell, APIs, or similar technologies.
• Preferred: Experience with remediation SLAs, risk exceptions, governance processes, security frameworks, or regulatory requirements.
• Preferred: Security+, CISSP, GIAC, Qualys, or equivalent industry certifications.

Responsibilities:

• Manage vulnerability findings from identification and technical triage through remediation, validation, and closure.
• Analyze scanner results and contextual risk information, including CVE, CVSS, CISA KEV, EPSS, vendor advisories, threat intelligence, exploitability, exposure, and business impact.
• Investigate findings to establish applicability, affected technology, root cause, severity, ownership, and organizational risk.
• Identify false positives, duplicates, accepted risks, compensating controls, and exceptions requiring validation or documentation.
• Identify responsible infrastructure, application, cloud, system, or business owners and communicate remediation needs clearly.
• Track findings against remediation timelines and SLAs, follow up on open items, escalate overdue or high-risk vulnerabilities, and support urgent responses to critical or actively exploited threats.
• Provide remediation teams with technical context, vendor guidance, mitigation options, and practical recommendations.
• Validate fixes through rescanning, targeted testing, manual review, or supporting evidence, and ensure findings are accurately dispositioned in the vulnerability platform.
• Operate and optimize enterprise vulnerability management platforms such as Qualys VMDR, Tenable, and Rapid7.
• Maintain platform searches, dashboards, asset groups, tags, reports, authentication, agents, scan coverage, and data quality.
• Develop risk-based reporting and metrics covering vulnerability trends, aging, recurrence, remediation performance, and systemic weaknesses.
• Collaborate with Asset Management, Infrastructure, Cloud, Application Security, Security Operations, Threat Intelligence, Governance, and business teams to improve coverage, ownership, and remediation outcomes.
• Maintain procedures, playbooks, and program documentation; find opportunities to automate recurring workflows and advance program maturity.
• Provide technical guidance and mentorship to junior team members.

Technologies:

• AWS
• Azure
• Cloud
• CMDB
• Support
• JIRA
• Linux
• Power BI
• PowerShell
• Python
• Security
• ServiceNow
• Splunk
• Windows
• DevOps

More

We are seeking a Senior Vulnerability Management Engineer for a long-term role based in Plano, Texas. In this hands-on position, you will help support and mature our enterprise vulnerability management program, translating technical findings into clear, risk-based actions for infrastructure, application, cloud, security, and business stakeholders.

last updated 43 week of 2026