Senior Vulnerability Engineer

King County Information Technology (KCIT) is seeking a Senior Vulnerability Engineer to join the Information Security, Risk & Compliance team and lead the technical execution of its enterprise vulnerability management program. The role is responsible for identifying, assessing, validating, and prioritizing vulnerabilities across infrastructure, cloud environments, applications, and network devices. It serves as the technical authority ensuring vulnerabilities are accurately identified, risk-prioritized, and remediated according to policies and SLAs.

The position collaborates closely with infrastructure, application, cloud, networking, security operations, and governance teams to reduce cyber risk through continuous monitoring, threat-informed prioritization, automation, and process improvement. Additionally, the engineer provides technical leadership in evaluating emerging threats, implementing vulnerability technologies, developing remediation strategies, and advancing program maturity.

King County is committed to being the best-run government in the nation, and King County Information Technology (KCIT) is helping lead that transformation. KCIT harnesses the power of technology to modernize operations, advance digital equity and social justice, and deliver innovative solutions that engage, empower, and serve our residents, businesses, and community partners.

Recognized by the National Association of Counties (NACo) for excellence in vision, strategy, innovation, and collaboration, KCIT is focused on delivering smart, secure, and customer-centered technology services that strengthen county operations and support thriving, resilient communities. As the technology business partner to all 18 County departments, KCIT provides the foundational systems and services that power many of the region’s most essential functions.

We work side-by-side with our partners to design and deliver technology solutions that enhance customer experience and advance King County’s mission. Learn more about KCIT at: http://King County.gov/depts/it.aspx.

This recruitment may be used to fill additional vacancies that may occur.

• Manage enterprise vulnerability scanning
• Validate scanner accuracy and investigate false positives
• Tune scan templates and credentials
• Maintain asset inventory coverage
• Monitor scan health and failures
• Validate remediation effectiveness
• Maintain vulnerability exceptions
• Track remediation SLAs
• Support external penetration testing

• Evaluate potential impacts of vulnerabilities
• Reviewing Microsoft's Patch Tuesday releases
• Assess vendor advisories
• Monitor threat intelligence feeds
• Determine emergency patch requirements
• Develop remediation recommendations

• Integrate vulnerability platforms with ticketing systems
• Automate remediation workflows
• Develop Power Shell/Python scripts
• Create APIs between scanning platforms and CMDBs
• Automate executive reporting
• Reduce manual effort

• Communicate vulnerability findings to stakeholders in clear, business focused language
• Provide guidance on remediation strategies, expected timelines, and resource needs
• Coordinate with engineering, product, infrastructure, and operations teams to ensure timely vulnerability resolution
• Set and manage expectations around remediation windows, technical constraints, and risk acceptance considerations
• Build and maintain strong cross-functional relationships with technical teams, leadership, and compliance groups
• Recommend secure development practices and process improvements based on recurring vulnerability patterns
• Act as the escalation point for high-risk or complex vulnerabilities requiring urgent…