Vulnerability Management Engineer

Position: VULNERABILITY MANAGEMENT ENGINEER
Job Description:

Location:

This position requires the candidate to work onsite 2-3 days a week in Seattle, WA. Potential opening for remote candidates in PST.

Job Description:

This position supports advancing the enterprise vulnerability management program across four functional pillars:
Detect, Prioritize, Report, Remediate. Detect: – Maintain and expand scan and sensor coverage across endpoints, servers, cloud workloads, containers, network devices, and SaaS – Close asset visibility gaps, including shadow IT, unmanaged devices, and assets provisioned outside IT – Tune authenticated scanning, credential health, agent health, and scan cadence to reduce false negatives – Reconcile vulnerability data across multiple sources into a single authoritative inventory Prioritize: – Build and operate risk-based prioritization that blends CVSS severity, EPSS likelihood, CISA KEV exploitation status, and SSVC decision logic – Enrich findings with business context: asset criticality, data classification, internet exposure, compensating controls, application owner, and business unit – Replace severity-only queues with defensible, tiered remediation SLAs – Operate the exception and risk acceptance workflow, including expiration and re-review Report: – Design and publish program metrics: coverage, mean time to remediate by tier, backlog aging, SLA compliance, and burndown – Deliver executive and operational dashboards, including Power BI reporting fed by automated pipelines – Produce audit and assurance evidence on request – Translate technical findings into business risk language for non-technical stakeholders Remediate: – Drive remediation campaigns in partnership with IT operations, endpoint, cloud, and application teams – Automate ticket creation, routing, and closure into the ITSM platform – Perform closed-loop verification that remediation actually reduced exposure – Support emergency response for actively exploited vulnerabilities Platform and program: – Direct, hands-on experience implementing or migrating to a new enterprise vulnerability management platform, including requirements definition, proof of concept, integration, data migration, and rollout – Direct experience driving continuous improvement to an established VM program, including maturity assessment, process redesign, and runbook development

Required Qualifications – 5+ years hands-on vulnerability management or security engineering – Direct implementation experience with at least one enterprise VM platform (Tenable, Qualys, Rapid7, Microsoft Defender Vulnerability Management, or Tanium) – Demonstrated experience building prioritization models that incorporate business context, not severity alone – Scripting and automation to scale program operations:
Python and Power Shell, plus REST API integration – Working fluency with KQL or an equivalent query language for security data – Experience integrating VM data with CMDB, ITSM, and BI platforms – Cloud vulnerability management experience across Azure and at least one other provider – Ability to work independently and produce written deliverables without heavy oversight Preferred

– Experience with Tanium and Microsoft Defender for Endpoint as data sources – Container and image scanning experience – Familiarity with NVD, EPSS, KEV, and ExploitDB data feeds and their API consumption patterns – Exposure to CTEM or exposure management program models –

Certifications:

CISSP, GIAC (GEVA, GCIA), AZ-500 Pay Range: $75.00 – $85.00 per hour, depending upon experience. Health & Medical Benefits, 401K, Employee Assistance Program, and Sick Time applicable by state. SLA Describe hiring preference (C/CTH/FTE) 12 month contract Bill rate or FTE Salary range and target:
Target rate:
We need to make our best offer, so let’s discuss rates, keeping in mind they can go a bit higher than for our other clients. Potential target: $140 to $155/hr Work Authorization Requirements:
No C2C without approval 1099 ok Budget Confirmed? Yes Why is the position open? New role How long has the position been open? Just opened Is there HR/vendor competition? Exclusive? Competition – this is an RFP process Interview Process: 2…