Threat & Exposure Management Platform Engineer

We are looking for a highly experienced Threat & Exposure Management Platform Engineer to design, build, and operate the data platform and architecture that unifies threat, vulnerability, and exposure signal across the enterprise. This is a foundational, high-impact platform engineering role at the core of our organization's evolution toward a next-generation, AI-enabled security operations capability.

You will own the architecture connecting security tooling, threat intelligence, vulnerability data, and adversary validation results into a single, continuously updated substrate — enabling faster, more accurate, and increasingly automated risk prioritization and response across the business.

This role calls for someone with deep platform engineering expertise and strong architectural judgment, comfortable owning complex, mission‑critical systems end‑to‑end rather than working on isolated components.

• Data Pipeline Engineering:
  Design, build, and operate scalable, resilient data pipelines that ingest, normalize, and enrich threat and exposure signals from a wide range of security, IT, and cloud platforms (e.g., vulnerability scanners, EDR/XDR, CSPM, CMDB, threat intelligence feeds, identity systems).
• Platform Integration:
  Develop and maintain robust API integrations connecting security tooling, data lakes, and correlation/analytics engines to create a single, unified view of the organization’s threat and exposure posture.
• Correlation Engine Development:
  Architect and implement correlation logic and data models that link vulnerabilities, threats, assets, and business context to support automated, evidence‑based risk prioritization.
• Data Substrate & Architecture Ownership:
  Build and evolve the underlying data substrate (schemas, storage layers, streaming infrastructure) that serves as the authoritative source of truth for enterprise risk and exposure data, and own its long‑term architectural direction.
• API & Interface Development:
  Expose clean, well‑documented, secure APIs enabling downstream systems, dashboards, and analyst tooling to consume unified threat and exposure data programmatically.
• Continuous Exposure Lifecycle Support:
  Build and operate the platform capabilities that support an ongoing, iterative approach to discovering, prioritizing, and validating exposures across the environment — from initial scoping through to remediation tracking.
• Adversary‑Informed Validation Integration:
  Integrate outputs from adversary emulation, control validation, and simulation exercises into the correlation engine, enriching risk prioritization with real‑world evidence of exploitability and defensive effectiveness.
• Coverage & Gap Analysis:
  Architect data models and pipelines that continuously assess defensive coverage against real‑world attack techniques, surfacing prioritized gaps for remediation.
• Operational Reliability:
  Own the uptime, performance, scalability, and data quality of production pipelines and integrations; implement monitoring, alerting, and self‑healing mechanisms.
• Cross‑Platform Normalization:
  Establish common taxonomies and data standards to reconcile inconsistent data formats, severity scoring, and asset identifiers across heterogeneous security tools.
• Cross‑Functional
  
  Collaboration:
  
  Partner with security operations, threat intelligence, detection engineering, red/purple team, and data science functions to ensure platform outputs meet operational and analytical needs.
• Security & Compliance:
  Ensure all data handling, storage, and access adhere to enterprise security, privacy, and regulatory requirements, given the sensitivity of threat and exposure data.
• Automation & Scale:
  Drive automation of data onboarding for new tools and platforms to reduce integration lead time as…