Lead Vulnerability Management Engineer
Leads architecture, technology integration, scanning, risk prioritization, and remediation strategy for a global vulnerability management program. The role requires senior-level vulnerability management experience, security framework expertise, audit support, and the ability to automate workflows with AI.
About the job
Responsibilities
- Serve as the primary technical lead for the Vulnerability Management team, providing architectural guidance and mentoring.
- Lead architecture, systems design, technology evaluation, and systems integration for the global vulnerability management program.
- Conduct advanced vulnerability scanning and validate findings, filter false positives, and triage and prioritize critical risks.
- Collaborate with technology owners and engineering teams to drive remediation or mitigation of complex vulnerabilities.
- Manage and track the remediation backlog and report on systemic security trends and risk-reduction progress.
- Design and implement AI-driven solutions to automate the vulnerability lifecycle and repetitive operational tasks.
- Improve global vulnerability management standards, procedures, and playbooks.
- Liaise with GRC teams to translate technical vulnerabilities and mitigations into compliance context for SOC 2, PCI-DSS, and FedRAMP readiness.
- Own technical reporting and evidence generation for audits, ensuring scanning cadences and remediation workflows meet compliance baselines.
- Translate regulatory requirements into technical scanning policies and integrate mandated checks into the scanning program.
- Be available for occasional on-call support outside standard working hours.
Requirements
- 5+ years of vulnerability management experience in a senior or lead technical capacity.
- Bachelor's degree in Computer Science, Information Security, or a related field, or relevant security certifications.
- Strong understanding of security frameworks such as SOC 2, NIST, and PCI.
- Strong communication, interpersonal, and analytical skills.
- Understanding of CVSS and EPSS risk-scoring methodologies.
- Hands-on experience with vulnerability scanning platforms such as Qualys, Nessus, or Rapid7 InsightVM.
- Experience using AI to develop and manage complex workflows and applications.
- Experience supporting GRC or external audit cycles, including PCI-DSS, SOC 2, or ISO 27001.
- Ability to translate compliance requirements into technical scanning configurations and remediation SLAs.
Nice-to-haves
- Python or other scripting languages for automation.
- AI development tools such as Opencode or Windsurf.
- JIRA or similar ticketing tools.
- Infrastructure penetration-testing tools.
Compensation and Benefits
- Eligible to participate in Cloudflare's equity plan.
- Medical, dental, and vision insurance.
- Flexible spending and commuter spending accounts.
- Fertility and family-forming benefits.
- Mental health support and Employee Assistance Program.
- Global travel medical insurance.
- Short- and long-term disability insurance.
- Life and accident insurance.
- 401(k) retirement savings plan.
- Employee stock participation plan.
- Flexible paid time off and leave programs, including parental, pregnancy health, medical, and bereavement leave.
Skills
Vulnerability Management, Vulnerability Scanning, Qualys, Nessus, Rapid7 Insightvm, Cvss, Epss, Python, Artificial Intelligence, Jira, Nist, Pci-Dss, SOC 2, ISO 27001, FedRAMP
Similar jobs
Security Engineering jobs
Idme
McLean, VA
Leads cloud-native security operations, incident response, threat hunting, and forensic investigations while mentoring SOC analysts and improving detection processes. Requires 8+ years in information security, including hands-on cloud incident response and experience with Kubernetes, CI/CD, and advanced security tools.
ConductorOne
San Francisco, CASenior Security Engineer responsible for application, cloud, and platform security, with a focus on automating security workflows, threat modeling, secure development, and remediation. Requires hands-on SaaS security, cloud infrastructure, code review, and agent or automation experience.
Mercor
San Francisco, CA
Leads the company’s security GRC function, owning SOC 2, ISO 27001, enterprise audits, third-party risk, policy governance, and automated evidence workflows. Requires 7+ years of GRC or audit experience, end-to-end SOC 2 and ISO 27001 ownership, and strong security tooling expertise.
Anthropic
San Francisco, CALeads technical SOX controls assurance for financially significant systems, translating audit requirements into engineering acceptance criteria and continuous monitoring. Requires ITGC and SOX 404 expertise, strong engineering fluency, programming ability, and cross-functional collaboration with Finance, Engineering, and auditors.
Discord
United States
Senior platform security engineer responsible for building identity and access management systems, Zero Trust architecture, cloud security baselines, and secure developer platforms. Requires 5+ years operating production systems and strong software development and security experience.