Advanced Security Engineer - Exposure Management

Description

This is a hands-on, technically deep role that builds out the company's exposure management work. You will find and add context to vulnerabilities, misconfigurations, unmanaged assets, and container and API posture risks across the technology estate.

You will tie each finding to asset criticality, how easily it can be exploited, compensating controls, internet exposure, and threat intelligence. The result is a current, ranked view of the exposures that matter most.

You will work with engineering and department leaders and with Governance Risk Intelligence, Product Security Enablement, Adaptive Security, the Purple Team, Threat Detection & Response, and application and service owners. Your job is to widen discovery and context coverage, show residual risk and how long exposures have been open, and run reduction campaigns that help owning teams fix the top items.

You drive prioritization, reporting, and follow-through on remediation. Risk-acceptance decisions, policy, and the remediation work itself stay with the accountable teams.

Responsibilities

• Run and improve the tools that find internet-facing, unmanaged, shadow, and newly introduced assets.
• Check discovery results against the authoritative asset inventory and ownership records, look into coverage gaps, and improve which application, service, or department each asset belongs to.
• Build repeatable workflows and automation that shorten discovery time and improve coverage, data quality, and visibility across asset classes.
• Analyze vulnerabilities and misconfigurations from exposure management and partner-team sources, weighing exploitability, asset criticality, internet exposure, compensating controls, and threat intelligence.
• Design, tune, and document prioritization logic that goes beyond raw severity, and keep a defensible, risk-ranked exposure backlog.
• Investigate high-impact vulnerabilities, zero-days, and serious misconfigurations in depth, and explain to technical and non-technical audiences why each one matters.
• Work with the Purple Team and other security functions to test prioritization assumptions and better match top exposures to confirmed exploitability.
• Keep an accurate inventory and risk view of live containers and APIs, covering running-image risk, workload ownership, API posture, and production context.
• Check build and deployment findings from Adaptive Security against production runtime data to see which risks still apply once workloads are live.
• Find systemic container and API posture problems and build prioritized fix campaigns for the teams that own those applications and services.
• Feed external and internal threat intelligence into exposure scoring, including active exploitation, adversary behavior, and emerging vulnerability signals.
• Track changes in the threat landscape and judge how they affect the company's exposed technologies, assets, containers, and APIs.
• Send timely alerts when new intelligence meaningfully changes the likelihood or priority of an existing exposure.
• Build and maintain dashboards, reports, and data pipelines that show residual exposure by department, asset class, severity tier, owner, and age.
• Define and track discovery coverage, context coverage, exposure aging, reduction rate, and residual risk trend, and look into data quality or performance problems that undermine the reports.
• Turn complex exposure data into clear findings, trends, and recommended actions for engineering leaders, department leaders, Governance Risk Intelligence, and service-owning teams.
• Monitor high-priority exposures against expected fix dates, flag aging and overdue items, and follow up with the owning application and service teams.
• Plan and run targeted reduction campaigns with measurable goals, and report progress, blockers, and residual risk to stakeholders.
• Send exposures that need risk-acceptance guidance to the owning team and Governance Risk Intelligence, and send findings that need manual review, threat modeling, or adversary validation to the right security function.
• Give technical guidance and prioritization context without taking ownership of risk acceptance, policy, or remediation.

Requirements

• Two to six years of hands-on experience in vulnerability management, exposure management, attack surface management, cloud security, or a closely related security engineering field.
• Hands-on work with vulnerability scanning, exposure management, or attack surface management platforms, including analysis of vulnerabilities, misconfigurations, unmanaged assets, and posture findings.
• Experience ranking exposures by exploitability, asset criticality, internet exposure, threat intelligence, compensating controls, and business context, rather than by severity scores alone.
• Working knowledge of common enterprise and cloud technologies, including operating systems, networks, containers, APIs, and at least one major cloud platform.
• Familiarity with CVSS, CISA KEV, EPSS, NIST, MITRE ATT&CK, and CIS benchmarks.
• Proficiency in at least one scripting or automation language, such as Python, Bash, or PowerShell, used to combine security data, automate analysis, or improve exposure workflows.
• Ability to dig into complex exposure data, spot systemic risk patterns, and clearly explain prioritized findings and recommended actions to technical and non-technical people.
• Skills listed as required: Endpoint Security, Network Security, Penetration Testing, Security Architecture Design, Security Automation, Security Information, Security Information and Event Management (SIEM), Security Operations, Threat Modeling, Vulnerability Management.
• Preferred: a bachelor's degree in Computer Science, Cybersecurity, Information Security, or a related field, or equivalent practical experience.
• Preferred: hands-on experience assessing exposure in multi-cloud or cloud-native environments.
• Preferred: experience with enterprise vulnerability management, exposure management, attack surface management, or adjacent platforms.
• Preferred: familiarity with AI-enabled SecOps, such as ML-based risk prioritization or AI-assisted workflows.
• Preferred: basic knowledge of common cloud environments such as AWS, Azure, or GCP.
• Preferred: experience building dashboards, metrics, or data pipelines.
• Preferred: experience supporting compliance and audit work for SOC 2, ISO 27001, or FedRAMP from a technical controls perspective.
• Preferred: relevant certifications such as CC, SEC+, CySA+, or equivalent.

Conditions

The company pays competitively and fairly.

The role is hybrid or remote.

Expected base salary is between $104,000 and $156,000.

Final pay depends on experience depth, skill set, qualifications, and internal pay equity. Offers at the top of the range are not typical, so there is room for future salary growth.

Benefits

• Competitive base salary.
• Annual performance bonus.
• Long-term incentives.