Threat & Vulnerability Management Security Engineer II

The Security Engineer II is a key member of the Threat & Vulnerability Management team, responsible for reducing enterprise technology risk through the identification, assessment, prioritization, remediation, and ongoing management of vulnerabilities across the organization.

In this role, you will analyze and correlate vulnerability findings, apply risk-based decision making, and partner with application, infrastructure, cloud, Dev Ops, and risk teams to drive remediation through verified closure. You will also support vulnerability governance, exception management, metrics, reporting, and continuous program improvement to enhance overall security posture.

The role leverages security tooling, automation, integrations, and workflow optimization to enhance the efficiency and effectiveness of vulnerability management processes. The ideal candidate combines strong vulnerability management expertise with hands‑on technical skills, risk analysis capabilities, process improvement experience, and the ability to collaborate effectively across technical and business teams to deliver measurable risk reduction.

Threat & Vulnerability Management

• Own and continuously evolve the enterprise Vulnerability Management Program across the IT environment.
• Manage the end-to-end vulnerability lifecycle, including discovery, validation, risk prioritization, remediation tracking, exception management, verification, and reporting.
• Analyze threat actors, campaigns, industry trends, and emerging cyber risks to provide strategic threat intelligence that informs vulnerability prioritization, exposure management, and broader security and business decisions.
• Operate and optimize vulnerability assessment technologies to maintain comprehensive asset coverage, accurate findings, and actionable risk visibility.
• Correlate and prioritize findings across vulnerability management security platforms, attack surface management solutions, and threat intelligence sources.
• Apply risk‑based prioritization methodologies incorporating CVSS, CISA Known Exploited Vulnerabilities (KEV), exploitability, asset criticality, exposure, and business impact to identify and address the most significant risks.
• Partner with asset management and technology teams to improve asset inventory accuracy, security coverage, ownership attribution, and enterprise risk visibility.
• Design, develop, and maintain security automation capabilities that streamline vulnerability management and related security operations processes, improving efficiency, consistency, data quality, and remediation outcomes while maintaining appropriate governance and oversight.
• Build and enhance integrations, workflows, and tooling across security platforms to automate repetitive tasks, improve visibility and reporting, and enable scalable, end-to-end security operations.

Remediation & Governance

• Coordinate and drive remediation efforts across infrastructure, application, cloud, network, and other technical teams to ensure vulnerabilities are addressed in accordance with established service‑level objectives and risk severity.
• Lead coordinated response activities for critical vulnerabilities, zero‑day threats, and actively exploited CVEs, including rapid assessment, prioritization, remediation, and risk communication.
• Manage vulnerability exceptions, compensating controls, risk acceptance processes, and periodic exception reviews to ensure risks remain appropriately documented and governed.
• Develop and maintain vulnerability management policies, standards, procedures, runbooks, and reporting frameworks.
• Develop executive and operational metrics that measure risk reduction, remediation performance, vulnerability trends, asset coverage, SLA adherence, exception exposure, and…