Consulting Security Vulnerability Engineer

Consulting Security Vulnerability Engineer

Last year our HCA Healthcare colleagues invested over 156,000 hours volunteering in our communities. As a Consulting Security Vulnerability Engineer with HCA Healthcare you can be a part of an organization that is devoted to giving back!

The Consulting Security Exposure Engineer serves as the technical lead for Enterprise Exposure Prioritization within HCA Healthcare's Attack Surface Management (ASM) program. Reporting to the Manager, Attack Surface Management Governance & Architecture, this role is responsible for transforming security findings into prioritized, actionable exposure intelligence that enables informed risk decisions and accelerates enterprise risk reduction.

Operating within a Continuous Threat Exposure Management (CTEM) framework, this position develops and maintains enterprise exposure prioritization methodologies by integrating vulnerability data, attack surface intelligence, threat intelligence, adversarial validation, business criticality, asset ownership, and control effectiveness. The role ensures that exposures are consistently evaluated, attributed, prioritized, and routed to the appropriate remediation, governance, vendor management, or risk acceptance workflows.

The Consulting Security Exposure Engineer partners closely with Threat Intelligence Services, Red Team, Enterprise Security Architecture, Infrastructure Operations, Cloud Security, Product Security, Identity Security, Cyber Physical Security, and Enterprise Vulnerability Remediation teams to continuously improve HCA Healthcare's ability to identify the exposures that matter most to patient care, operational resilience, regulatory obligations, and enterprise trust.

Responsibilities include:

• Lead implementation and continuous improvement of the enterprise Exposure Prioritization program across all attack surface domains.
• Develop and maintain enterprise exposure prioritization methodologies incorporating business criticality, exploitability, threat intelligence, adversarial validation, asset context, ownership, and control effectiveness.
• Correlate findings from vulnerability management, cloud security, application security, cyber-physical systems, external attack surface management, identity security, and other security domains into unified exposure assessments.
• Develop and maintain exposure scoring models that accurately reflect enterprise risk and support executive decision-making.
• Partner with Threat Intelligence Services to integrate active threat campaigns, exploit intelligence, and adversary tradecraft into exposure prioritization.
• Partner with Red Team to incorporate adversarial exposure validation and attack path testing into prioritization decisions.
• Attribute exposures to business applications, enterprise assets, and accountable owners to support effective remediation routing.
• Support implementation of enterprise exposure routing models that direct findings to remediation teams, vendors, governance processes, or formal risk acceptance workflows.
• Develop dashboards, analytics, and reporting that measure exposure prioritization effectiveness, routing accuracy, ownership attribution, exposure aging, and overall attack surface risk.
• Collaborate with Enterprise Vulnerability Remediation, Infrastructure Operations, Cloud Engineering, Product Security, and business stakeholders to improve remediation prioritization and reduce exposure dwell time.
• Identify opportunities to automate exposure correlation, prioritization, enrichment, routing, and reporting through security orchestration and workflow automation.
• Provide technical leadership and mentorship regarding exposure management methodologies, threat-informed prioritization, attack surface analysis, and emerging exposure management technologies.
• Support development of executive metrics and outcome-driven reporting that demonstrate measurable reduction in enterprise cyber exposure.

Skills required include:

• Effective self-management skills
• Effective time management skills
• Effective organizational skills
• Effective written and oral communication skill
• Effective analytical skills
• Effective decision making in crisis scenarios
• Effective…