Staff Vulnerability Management Engineer

Overview

Staff or Senior Staff Engineer, Vulnerability & Exposure Management, an individual contributor role owning vulnerability discovery and remediation across web applications, APIs, and endpoints within the Product Security department.

What you'll do

• Build and operate automation across the entire vulnerability lifecycle: asset discovery, authenticated scanning, triage, routing to owners, and verifying closure
• Diagnose why authenticated web application and API scans fail, implement fixes, and systematically bring remaining services into active coverage
• Establish and run endpoint vulnerability management as a routine, collaborative operational program with IT
• Architect and implement scanning and assessment workflows for novel systems across application, API, and endpoint stacks
• Drive remediation to closure with engineering and IT teams while proactively identifying the next automation opportunities

What you'll need

• Foundational understanding of AI/ML technologies and experience leveraging, securing, or positioning AI-driven solutions to optimize outcomes within your functional domain
• Extensive professional experience in software or security engineering, with substantial dedicated depth in security engineering
• Hands-on experience developing and running security automation in production using Python, REST APIs, OAuth and token refresh, rate limiting, and data parsing and de-duplication
• Demonstrated ability to dissect and articulate vulnerability exploit mechanics from attacker input to operational impact, alongside the precise defensive controls required to stop them
• In-depth web application and API security expertise, including authentication flows, CWE-level vulnerability analysis, and the end-to-end vulnerability lifecycle across detection, prioritization, mitigation, and verification

Nice to have

• Experience leveraging AI/ML technologies and advanced orchestration platforms to design intelligent, self-service triage, automated remediation routing, and predictive exposure analysis workflows
• Hands-on experience deploying or administering enterprise security tooling such as Tenable, Qualys, CrowdStrike, Wiz, or Burp Suite, alongside working knowledge of AWS, Azure, or GCP
• Track record of building internal security tooling adopted by engineering teams, incorporating risk-based prioritization signals such as CISA KEV, EPSS, and asset criticality

Details

• Hybrid work mode, reporting to the Senior Manager, Information Security Engineering
• Location: Bangalore, India