Vulnerability Engineer

What your impact will be

• Faster, more consistent Vulnerability Risk Assessments. You'll own first-pass CVSS scoring and exploitability analysis, closing the SLA gap between finding and answer.
• Validated, trustworthy triage. You'll reproduce and confirm customer-reported and pen-test findings before they reach Engineering, so fix priority reflects real exploitability, not just scanner severity.
• Reliable scanning pipelines. You'll keep SAST/DAST and vulnerability scanning automations running, troubleshooting failures and tuning configs so the data everyone relies on stays clean.
• Real partnership with Engineering. You'll build or run PoC exploits on select CVEs, bringing validated risk, not just findings, into prioritization conversations.
• More capacity for the function. You'll free up our Staff Security Engineer to focus on program-level improvement instead of carrying all of vulnerability management's day-to-day load.

What we look for in this role

• Hands-on experience managing vulnerabilities for a large SaaS product, across OS, container, and dependency exposure.
• A track record triaging and tracking CVEs for a SaaS or containerized product: reading scan reports, prioritizing by severity, and following through to resolution.
• Experience reproducing and validating reported vulnerabilities, whether from customer disclosures or pen test findings, not just logging them.
• Time spent with vulnerability scanning tools such as Prisma Cloud/Twistlock, JFrog, or Trivy, including reconciling findings across tools.
• Comfort building or maintaining SAST/DAST pipeline automation, and triaging what the scans turn up.
• Experience partnering with Engineering to get fixes prioritized and shipped, not just reported.
• Background in a highly regulated environment or modern software company, ideally one that moves at startup or scale-up speed.