Vulnerability Management, Manager

What We Need:

You will serve as a technical subject matter expert with a strong focus on vulnerability management and a secure developer mindset. Your responsibilities will include designing, defining, and implementing security requirements, controls, and processes to facilitate the secure development and operation of cloud-based and on-premises applications. You will conduct architecture analysis, threat modeling, vulnerability assessments, and technical design reviews for sensitive features and infrastructure to identify risk and guide development and engineering teams in improving the overall security posture of our products.

You will develop process and automation for vulnerability detection, patch management, and remediation workflows, partner with application service teams to implement security standards and guidelines, and educate developers on application and cloud security best practices. Additionally, you will help create, enhance, and maintain security documentation.

• Demonstrate leadership aptitude through mentoring and practice maturation.
• Work independently and collaboratively with various teams.
• Implement, onboard, and enforce vulnerability management tools and processes (including SAST, SCA, IaC, DAST, IAST) in cloud-based CI/CD pipelines.
• Coordinate software and cloud security initiatives with relevant teams.
• Conduct and build data flow diagrams & threat modeling with application and infrastructure teams.
• Manage manual and automated vulnerability management for priority issues, including zero-day vulnerabilities.
• Develop and maintain patch management processes and schedules.
• Assist in developing source code review and vulnerability management checklists.
• Advise developers and engineers on secure coding and vulnerability mitigation strategies for Dev Sec Ops  CI/CD pipelines.
• Secure code repositories, release environments, and deployment tools.
• Perform application, cloud, and mobile penetration testing.
• Lead vulnerability management projects and collaborate with vendors to assess, implement, and utilize new security tools.

• Analytical mindset for problem solving, vulnerability prioritization, and offensive security tactics.
• Effective communication skills, both verbal and written, to clearly convey technical and non-technical concepts to diverse audiences.
• Current experience in vulnerability assessment, security testing, and remediation methodologies (including browser-based, API, CI/CD pipeline, mobile, and cloud environments).
• Developer focus and mid-level knowledge of tools such as Terraform, Kubernetes, Serverless functions, Jenkins, and cloud platforms (AWS, Azure, GCP).
• Experience in secure architectural design review, threat modeling, and technical design reviews.
• Expertise in patch management, vulnerability prioritization (CVSS, risk-based approaches), and zero-day vulnerability response.
• Strong knowledge of CI/CD processes and security tools for each stage, including SAST, SCA, IaC, DAST, IAST, and application penetration testing.
• Hands‑on experience with vulnerability exploitation and remediation in applications and cloud environments.
• Familiarity with repository management (Git Hub, TFS, AWS, Azure) and vulnerability management platforms.
• Experience with manual and automated vulnerability management and resolution across multiple teams.
• Strong understanding of securing cloud-based resources, including containers and basic services in AWS, GCP, or Azure.
• Knowledge of configuration and information management analysis (XML, JSON, etc.).
• Solid grasp of security principles, policies, and industry best practices.
• Familiarity with standards such as OWASP, SAMM, ASVS, NIST Special Publications.
• Minimum of 5 years’ experience in vulnerability management or application security.
• Minimum of 5 years’ experience in software development.
• Minimum of 5 years’ experience supporting security in CI/CD pipelines.
• Bachelor’s Degree or 7 years developer experience with 3 years of vulnerability management or application security experience, or equivalent required.
• Certifications in Security, Kubernetes, Docker, AWS, or equivalent are a plus.
• Ability to stay focused and follow through on…