Vulnerability Management Engineer

About The Role

The Vulnerability Management Engineer plays a critical role in ensuring the security of our systems by managing and mitigating vulnerabilities. Key responsibilities include reviewing vulnerability scanning reports, assessing severity, and triaging vulnerabilities, along with efficiently managing Jira tickets to facilitate timely remediation or mitigation. This role requires utilizing tools such as Vigiles, yocto CVE scanner to conduct vulnerability scanning and analysis, and implementing a risk-based prioritization method for effective management. Leading process optimization efforts by identifying gaps in the vulnerability management workflow and enhancing program efficiency is also essential.

Collaboration with an international security organization as well as engineering teams is necessary to provide guidance on mitigating and remediating vulnerabilities, identify and report automation bugs, and contribute to solutions that reduce manual workload in the vulnerability management lifecycle. The role involves investigating vulnerability alerts, assessing their impact, and calculating severity scores based on attack complexity. Additional duties include maintaining scanning tools, reviewing CVEs for potential risk exceptions, and guiding teams on security best practices and patch management standards. Flexibility to work across different time zones is crucial for effective global collaboration and system security.

Qualifications

• 7+ years in vulnerability management or network security with strong focus on Cisco technologies
• Experiences in Cisco IOS-XE architecture, including kernel components and security mechanisms
• In-depth knowledge of common Security vulnerabilities (OWASP Top 10, CWE Top 25)
• Proficiency with vulnerability scanning tools (Semgrep, blackduck, vigiles, yocto cve scanner) and firmware analysis
• Ability to trace through Linux kernel configuration systems (KCONFIG) and interpret Makefiles
• Strong C programming skills and understanding of conditional code compilation
• Experience with scripting languages (Python, Bash) and network analysis tools (Wireshark)
• Proven ability to collaborate effectively across global teams and multiple time zones
• Consistent track record to ship in a dynamic environment
• Experience using Jira and other Atlassian software
• Strong documentation skills and ability to present complex technical findings clearly