Senior Vulnerability Management Engineer

About the role

Senior Vulnerability Management Engineer position in Plano, TX within the Cybersecurity division. This hands-on technical role requires 4–8 years of experience and focuses on managing the complete vulnerability lifecycle across the enterprise — from identification and risk assessment through remediation, validation, and closure. Specialization in Enterprise Vulnerability Management, Security Engineering, and Risk-Based Remediation.

Responsibilities

• Manage end-to-end vulnerability identification, analysis, prioritization, remediation tracking, validation, and closure.
• Analyze scanner findings using CVE, CVSS, CPE, CISA KEV, EPSS, vendor advisories, threat intelligence, and exploitability data.
• Assess vulnerability severity, asset criticality, business impact, and organizational risk.
• Investigate false positives, duplicate findings, compensating controls, risk acceptance, and remediation exceptions.
• Coordinate with infrastructure, application, cloud, security, and business teams to drive timely remediation.
• Track remediation SLAs, escalate overdue and critical vulnerabilities, and support emergency remediation efforts.
• Validate fixes through rescanning, technical testing, manual reviews, and supporting evidence.
• Administer and optimize vulnerability management platforms, asset inventories, scan configurations, dashboards, and reports.
• Monitor vulnerability trends, aging, recurrence, remediation performance, and SLA compliance.
• Improve vulnerability management workflows through automation, documentation, reporting, and continuous program enhancement.

Requirements

• Bachelor's degree in IT, Cybersecurity, Computer Science, Business, or a related field, or equivalent professional experience.
• 4–8 years of hands-on experience in Vulnerability Management, Security Engineering, Infrastructure Security, or a related cybersecurity discipline.
• Strong experience with Qualys VMDR, Tenable, Rapid7, or equivalent enterprise vulnerability management platforms.
• Proven experience managing the complete vulnerability lifecycle in complex enterprise environments.
• Strong understanding of CVE, CVSS, CPE, exploitability, vulnerability severity, risk acceptance, compensating controls, and remediation methodologies.
• Technical knowledge of Windows, Linux, networking, servers, databases, middleware, virtualization, and cloud infrastructure.
• Experience coordinating remediation, managing SLAs and escalations, validating fixes, and communicating with stakeholders.
• Strong analytical, troubleshooting, documentation, prioritization, and organizational skills.

Preferred Qualifications

• Advanced experience with Qualys VMDR, including authenticated scanning, agent-based assessments, asset tagging, dashboards, and reporting.
• Experience with Attack Surface Management (ASM) or External Exposure Management.
• Knowledge of AWS, Microsoft Azure, or Google Cloud Platform (GCP).
• Experience integrating vulnerability management tools with SIEM, SOAR, CMDB, ITSM, ticketing, and asset management solutions.
• Familiarity with ServiceNow, Jira, Splunk, Microsoft Sentinel, and Power BI.
• Scripting and automation experience with Python, PowerShell, or REST APIs.
• Knowledge of CISA KEV, EPSS, exploit intelligence, remediation SLAs, governance, and compliance frameworks.
• Relevant certifications such as CompTIA Security+, CISSP, GIAC, or Qualys certifications.

Tools & Technologies

• Qualys VMDR, Tenable, Rapid7
• CVE, CVSS, CPE, CISA KEV, EPSS
• AWS, Azure, GCP
• Windows, Linux
• Splunk, Microsoft Sentinel
• ServiceNow, Jira, CMDB
• Power BI
• Python, PowerShell, REST APIs
• SIEM, SOAR