Information Security Engineer II

Metro Sys is seeking a skilled Information Security Engineer II to support and lead efforts around vulnerability management within a dynamic, enterprise-scale environment. This individual will be instrumental in identifying and addressing security vulnerabilities across systems, networks, and applications. The ideal candidate brings a deep understanding of vulnerability scanning tools, remediation prioritization, and collaborative risk mitigation strategies.

You will work closely with cross-functional teams to enhance the organization’s security posture and help ensure compliance with industry standards. If you thrive in fast-paced environments and are passionate about cybersecurity, this is an exciting opportunity to grow and make an impact.

• Lead the end-to-end vulnerability management lifecycle: scanning, analysis, prioritization, reporting, and remediation tracking.

• Perform regular vulnerability assessments and support remediation efforts in collaboration with infrastructure and application teams.

• Track and assess emerging threats and zero-day vulnerabilities using vendor bulletins and threat intelligence feeds.

• Generate reports and dashboards to communicate risk posture and mitigation progress to technical and executive stakeholders.

• Maintain and optimize vulnerability scanning tools to ensure full visibility and accurate detection across the environment.

• Assist in security incident response involving known or suspected exploited vulnerabilities.

• Support regulatory and compliance audits (e.g., PCI, NIST, HIPAA) by providing documentation and metrics.

• Continuously improve processes, documentation, and tooling in the vulnerability management program.

• Bachelor's degree in Computer Science, Cybersecurity, or a related field (or equivalent experience).

• 3+ years of experience in information security, with a strong emphasis on vulnerability management.

• Hands-on experience with scanning tools (e.g., Tenable, Qualys, Rapid7).

• Solid understanding of network architecture, operating systems (Linux, Windows), and web applications.

• Familiarity with CVSS scoring, risk modeling, and remediation prioritization frameworks.

• Ability to work with scripting or automation tools (Python, Power Shell, Bash) is a plus.

• Excellent communication and problem-solving skills; ability to clearly explain security findings to non-security audiences.

• Experience with compliance frameworks such as PCI DSS, NIST, HIPAA, or ISO 27001.

• Relevant certifications are a plus (e.g., CISSP, Security+, LFCS, RHCSA).