Vulnerability Management Engineer I

Vulnerability Management Engineer I

Key Responsibilities

• Validate vulnerability scan schedules and confirm scans are running as planned across assigned networks, subnets, and regions.
• Monitor scanner appliance health, scanner assignment, scan configuration, and scan failures, including offline scanners, authentication issues, access issues, and network connectivity problems.
• Raise, update, and follow up on incident or remediation tickets related to scanner failures, scan issues, and vulnerability remediation activities.
• Support approved ad hoc rescans for eligible assets, validate hostname, IP address, vulnerability details, and confirm whether remediation has successfully resolved the finding.
• Update remediation tickets with scan results, CSV reports, evidence, and clear remediation validation notes.
• Monitor vulnerability dashboards and extract reports from tools such as ArmorCode and CrowdStrike for findings, statistics, SLA tracking, and evidence collection.
• Review exception requests, validate affected assets, justification, evidence, asset owner, risk owner, exception category, and approval status.
• Support creation and maintenance of approved exceptions in vulnerability management platforms after required approvals are completed.
• Assist in handling vulnerability advisories by validating CVE availability, affected assets, impacted versions, and coordinating remediation follow-up with asset owners.
• Review finding reassignment requests, validate ownership evidence, prepare templates, and coordinate with internal stakeholders for reassignment review.
• Assist with External Attack Surface Management findings by identifying asset ownership, coordinating remediation, and supporting owner mapping activities.
• Support immediate follow-up for critical vulnerabilities that may impact external security ratings or business risk indicators.

Progressive Security Engineering Responsibilities

As the engineer gains experience and demonstrates operational maturity, they may gradually support selected security engineering activities under guidance. These may include security configuration assessment support, validation of asset onboarding requirements, review of approved security templates, coordination with engineering teams for tooling issues, and contribution to process improvement or automation initiatives.

Required Skills and Knowledge

• Basic understanding of cybersecurity concepts, vulnerabilities, risk ratings, CVEs, remediation, and patching.
• Foundational knowledge of networking concepts such as IP addresses, subnets, ports, protocols, and network connectivity.
• Basic familiarity with Windows, Linux, network devices, databases, and cloud or virtualized environments.
• Ability to work with dashboards, reports, CSV exports, tickets, and documented operational procedures.
• Good written communication skills for ticket updates, stakeholder follow-ups, and evidence documentation.
• Attention to detail and ability to validate asset information, vulnerability details, scan results, and exception evidence accurately.
• Willingness to learn vulnerability management platforms, IT service management tools, CMDB processes, and enterprise security workflows.

Preferred Qualifications

• Bachelor’s degree in computer science/information technology/Cybersecurity/Electronics or a related field.
• Cybersecurity fundamentals training or certifications such as Security+, CC, Network+, or equivalent learning exposure are preferred but not mandatory.

Behavioral Expectations

• Demonstrate ownership of assigned tasks and follow through until closure.
• Communicate clearly with internal teams, asset owners, and requestors.
• Follow documented procedures and escalate issues when required.
• Maintain accuracy in reporting, ticket updates, and evidence handling.
• Show curiosity, willingness to learn, and readiness to grow into broader security engineering responsibilities.
• Work effectively in a remote environment with regular updates, collaboration, and disciplined time management.

The above statements are intended to describe the general nature and level of work being performed. They are not intended to be construed as an exhaustive list of all responsibilities, duties, and skills.