Vulnerability Security Engineer

Position Overview:

Job Responsibilities:

Vulnerability & Exposure Management
 Engineer and mature the Crowdstrike Vulnerability Management platform, optimizing scan coverage, asset tagging, credential management, and API integrations.
 Champion Risk-Based Vulnerability Management (RBVM) by contextualizing vulnerabilities with threat intelligence (e.g., CISA KEV, EPSS, CVSS) to prioritize remediation of high-risk assets.
 Partner closely with infrastructure and cloud teams to drive remediation within established SLAs, transforming monthly patch meetings into data-driven risk discussions.
 Design and maintain automated reporting dashboards and KPIs/KRIs to track scan health, remediation velocity, and overall risk reduction.
 Formulate and drive the remediation strategy for End-of-Life (EOL) systems, acting as a primary advisor on legacy system risk mitigation.
PKI, Cryptography & Machine Identity Management
 Lead the Enterprise Certificate Lifecycle Management (CLM) strategy:
o Oversee issuance, renewals, and revocation of SSL/TLS certificates,ensuring zero unplanned downtime due to expirations.
o Drive PKI automation initiatives (e.g., utilizing ACME, SCEP, or REST APIs) to transition from manual ServiceNow requests to zero-touch provisioning.
 Architect and maintain proactive, continuous monitoring and alerting for all managed internal and public-facing certificates.
 Manage certificate issuance processes through root authorities like DigiCert (including specialized certs like Verified Mark Certificates/VMC).
 Act as the Subject Matter Expert (SME) for internal Certificate Authority (CA) architecture, advising on cryptography best practices, key generation, and secure secrets management.

Basic Qualifications:

 5+ years of experience in IT security or infrastructure, with a specialized focus on vulnerability risk management and PKI operations.
 Hands-on administrative experience with Crowdstrike Falcon Spotlight, Qualys, or similar enterprise-grade exposure management platforms.
 Deep experience managing SSL/TLS certificates via platforms like Sectigo, DigiCert, or Venafi, with a strong track record of automating certificate deployments.
 Solid understanding of vulnerability prioritization frameworks, infrastructure patching lifecycles, and integration with ITSM tools (e.g., ServiceNow/Jira for automated ticketing).
 Strong technical grasp of internal PKI/CA principles, modern cryptography, and machine identity best practices.
 Proven ability to influence cross-functional technical teams, driving remediation efforts without direct authority.
 Excellent technical documentation and communication skills, capable of translating technical vulnerabilities into business risk.

Preferred Skills:

Experience integrating Vulnerability Management or PKI workflows with orchestration/automation tools (e.g., Python, PowerShell, Ansible, or SOAR platforms).
 Experience with External Attack Surface Management (EASM) or Cloud Security
Posture Management (CSPM) tools.
 Advanced understanding of EOL system risk mitigation (network segmentation, virtual patching).
 Security certifications such as CISSP, CISM, GIAC (e.g., GSEC, GCIA), or specific vendor certifications.
 Bachelor's degree in Cybersecurity, Information Technology, or a related field