Principle Vulnerability Analyst

Our Purpose

Mastercard powers economies and empowers people in 200+ countries and territories worldwide. Together with our customers, we're helping build a sustainable economy where everyone can prosper. We support a wide range of digital payments choices, making transactions secure, simple, smart and accessible. Our technology and innovation, partnerships and networks combine to deliver a unique set of products and services that help people, businesses and governments realize their greatest potential.

Principle, Vulnerability Analyst Overview

• The AI Vulnerability Operations team is responsible for turning AI-identified security findings into validated, prioritized, and remediated risk reduction across Mastercard's software environment.
• This position is for a Principal Vulnerability Analyst who will work directly with application, engineering, product, and security teams to validate vulnerabilities identified through AI models and drive them through remediation.
• The role will focus on determining whether AI-generated findings are exploitable, relevant, reachable, and material to the application or service being evaluated.
• This position will help translate AI model outputs into clear technical guidance, remediation actions, risk decisions, and measurable vulnerability reduction outcomes.
• The Principal Vulnerability Analyst will also provide feedback into AI vulnerability workflows to improve model precision, reduce false positives, identify missed context, and strengthen operational processes over time.

• Validate vulnerabilities identified by AI models by reviewing code context, dependency data, application architecture, runtime exposure, compensating controls, and exploitability evidence.
• Partner with application and engineering teams to confirm ownership, assess impact, determine remediation options, and drive vulnerabilities to closure.
• Translate AI-generated vulnerability findings into clear, actionable remediation guidance that engineering teams can implement efficiently.
• Triage AI findings to distinguish true positives, false positives, duplicates, accepted risks, configuration issues, dependency issues, and findings requiring additional analysis.
• Assess vulnerability severity using available evidence, including exploitability, reachability, data sensitivity, business criticality, external exposure, dependency paths, and compensating controls.
• Facilitate remediation discussions with product owners, developers, security engineers, and platform teams to remove blockers and maintain momentum on high-risk issues.
• Verify remediation outcomes by reviewing code changes, dependency updates, configuration changes, compensating controls, retest results, and supporting evidence.
• Document validation rationale, remediation decisions, residual risk, and closure evidence in vulnerability tracking and reporting systems.
• Identify patterns across AI-generated findings and recommend improvements to secure coding practices, dependency management, build processes, and application security controls.
• Provide feedback to AI model, data, and platform teams on finding quality, missing context, false positives, false negatives, prompt or workflow gaps, and opportunities for better prioritization.
• Support prioritization of AI-identified vulnerabilities across critical, externally exposed, and high-risk applications to ensure remediation efforts focus on the areas of greatest risk.
• Create playbooks, decision trees, validation standards, and remediation guidance to make AI vulnerability operations more consistent and scalable.
• Mentor analysts and engineers on vulnerability validation, risk-based prioritization, secure remediation practices, and effective engagement with application teams.
• Prepare executive-ready summaries, risk narratives, metrics, and status updates that communicate remediation progress, blockers, and residual risk.
• Continuously improve the AI vulnerability validation lifecycle by reducing manual effort, improving evidence quality, and strengthening handoffs between AI tooling, analysts, and engineering teams.

• Strong experience in vulnerability management, application security, secure…