Senior Cybersecurity Engineer – Vulnerability Exposure Management

Description

The company's Vulnerability Exposure Management team is hiring a senior engineer to act as the lead technical contributor for manufacturing and operational technology (OT) environments.

You will own the engineering and ongoing improvement of the processes, data, scoring, tooling and stakeholder workflows used to handle vulnerabilities across manufacturing and industrial sites.

The role suits an engineer who can bridge cybersecurity operations and plant disciplines, earn trust with plant staff, and take complex exposures from discovery through verified remediation.

Responsibilities

• Set remediation priorities for plant systems by weighing exploitability, asset criticality, production impact, safety, uptime, fix complexity, maintenance windows, network position and existing mitigations.
• Combine data from OT discovery platforms, scanners, the CMDB, network sources, plant context, threat intelligence and remediation systems into one view of each exposure.
• Apply the company's risk model and OT and manufacturing environmental variables to produce ratings that match real plant conditions.
• Assess how exploit impact, fix complexity, mitigations, segmentation and operational limits change the final risk priority.
• Triage exposures using CVSS, EPSS, CISA KEV and industrial context, accounting for the limits of legacy manufacturing hardware.
• For each vulnerability, record the affected OT hardware or software, the accountable owner, the recommended fix and the target date.
• Serve as the main security contact between manufacturing cybersecurity, plant IT and floor automation engineers, and agree risk-based mitigation plans with them.
• Lead rapid response to high-impact ICS vulnerabilities, actively exploited flaws and new threats to manufacturing technology.
• Define KPIs for exposure reduction and remediation speed, and turn plant-floor risk into dashboards that executives can read.
• Build and mature AI capabilities for data ingestion and asset enrichment, attack path and risk prioritization, and remediation workflow automation.
• Enrich scanner findings with asset, business, network, telemetry, identity, threat intelligence and SBOM data so that fixes go first to the exposures most likely to cause business harm.
• Use threat intelligence and exploitability analysis, including exposure context, attack paths and signs of exploitation, to rank work beyond severity scores alone.
• Mentor less experienced engineers and advise the teams who own remediation.

Requirements

• Required: a bachelor's degree in cybersecurity, computer science, engineering, IT or a related field, or equivalent practical experience.
• Required: experience in cybersecurity engineering, vulnerability management, security operations, manufacturing IT/OT, ICS, infrastructure security or a related area.
• Required: working knowledge of PLCs, robots, HMIs, industrial automation, engineering workstations and plant-floor systems.
• Required: experience in large-scale enterprise automotive or manufacturing operations.
• Required: experience reviewing third-party OEM software and firmware updates and coordinating securely with outside field engineering vendors.
• Required: knowledge of industrial networking and protocols such as IECN/PFCN, Industrial Ethernet, EtherNet/IP, DeviceNet, Profibus or comparable technologies.
• Required: experience prioritizing vulnerabilities where patching is limited by safety, production, availability, vendor support or maintenance windows.
• Required: understanding of CVSS, EPSS, CISA KEV, exploit maturity, active exploitation, attack paths and risk-based prioritization beyond severity.
• Required: experience with remediation governance, exception management, dashboards, metrics and executive reporting.
• Required: experience linking vulnerability findings with business, asset, identity, telemetry, network, SBOM and threat intelligence data to support risk-based, exploitability-focused decisions.
• Required: a solid grasp of remediation governance, exception handling, dashboarding, metrics and continuous improvement in a mature vulnerability program.
• Required: familiarity with enterprise and OT security platforms such as Armis, Claroty, Tenable, Qualys or Dragos, and a strong understanding of network segmentation, VLANs and plant-floor port configuration.
• Required: experience designing compensating controls and alternative mitigations when immediate patching is impossible because of plant uptime limits.
• Required: ability to work independently, use sound judgment and deliver results with little guidance.
• Required: proven ability to solve complex, ambiguous problems through structured analysis and creative approaches.
• Required: strong communication and influence skills, including presenting recommendations backed by data and analysis.
• Preferred: experience running a full vulnerability intelligence workflow for a high-profile CVE, from first awareness through intelligence gathering, relevance scoping, contextual scoring and outputs for executive and technical audiences.
• Preferred: ability to judge exploitability when public information is thin, by reasoning about attack complexity, required privileges, user interaction, environmental preconditions and control effectiveness, and by updating advice as proof-of-concept code and tools appear.
• Preferred: proven record of responding to high-impact zero-days in critical third-party products, quickly validating unclear intelligence, scoping exposure, recommending interim mitigations and structuring updates within the first 24 to 72 hours.
• Preferred: ability to reconcile conflicting vulnerability data from vendors, scanners, commercial feeds and internal observations, and to set a defensible, environment-specific rating with documented reasoning.
• Preferred: experience defining and using leadership metrics and dashboards that combine scanner, CMDB, ticketing and threat-intelligence data to track remediation urgency, business exposure and time-to-remediate.
• Preferred: knowledge of the ISA/IEC 62443 and NIST SP 800-82 industrial cybersecurity frameworks for assessing and managing exposure.
• Preferred: knowledge of the NIST Cybersecurity Framework (CSF 2.0) and CISA Cross-Sector Cybersecurity Performance Goals (CPGs) for governing, scoring and aligning technical vulnerabilities with enterprise risk metrics.

Conditions

Hybrid role: you are expected to work from a specific location at least 3 times a week, or as often as your manager sets.

The company does not provide immigration sponsorship for this role, including direct sponsorship, the company as employer of record on a government form, or any work authorization that needs a written submission or other immigration support from the company, such as H-1B, OPT, STEM OPT, CPT, TN or J-1. Do not apply if you will need such sponsorship now or later.

Relocation benefits are available to candidates who qualify under company policy.

Candidates may need to complete a role-related assessment and or a pre-employment screening before starting.

Requisition code: LI-SB3.

The company provides equal employment opportunity without regard to unlawful discrimination.

Benefits

• Support for well-being at work and at home from the first day.
• Access to total rewards information covering the package.