Security Engineer, Vulnerability Management

Overview

Build and run LiveKit's vulnerability management and security operations program, owning it end to end on a small Trust team covering security, IT and compliance.

What you'll do

• Select, deploy and operationalize scanning tooling across production assets.
• Run vulnerability management end to end: triage, severity in our environment, owner assignment, remediation SLAs and reporting.
• Build engineering-first triage and remediation workflows that fit how engineering teams already work, and automate routing and follow-up.
• Build a remediation dashboard that engineering and leadership read and act on.
• Automate collection of the vulnerability management evidence that compliance programs depend on, in partnership with the Compliance team.
• Build automation, including agentic tooling, that removes manual security operations work and keeps pace with engineering growth.

What you'll need

• 5+ years in security engineering, security operations or software engineering, with a significant share focused on security.
• Hands-on experience building or running a vulnerability management program or software security tooling (SCA, container, cloud or host scanning).
• An engineering-first approach to triage and remediation.
• The judgment to set a finding's real severity in our environment, using CVSS as one input.
• Strong scripting and automation skills in a language such as Go or Python.
• Comfort reading infrastructure as code such as Terraform.
• A pragmatic approach to risk: explaining why a finding matters to the business and how fast it needs to be fixed.
• Ability to clearly explain complex technical concepts to others.

Nice to have

• Experience with real-time media, networking or WebRTC systems.
• Experience supporting compliance audits such as HIPAA, PCI-DSS, ISO 27001 or SOC 2.
• Incident response or application security experience.
• Experience in AI security, such as securing LLM applications or agent infrastructure.

Details

• Location: United States (Remote).