Staff Vulnerability Management Engineer

Overview

Staff Vulnerability Management Engineer responsible for leading vulnerability disclosure, reporting, and response processes at large scale. This individual-contributor role provides technical leadership, cross-team influence, and ownership of complex security problems.

What you'll do

• Manage the novel vulnerabilities pipeline.
• Measure, disclose, and report thousands of vulnerabilities identified weekly.
• Calibrate response processes for emerging trends.
• Report vulnerabilities to upstream projects and maintainers.
• Run the CNA program and assign CVEs where necessary.
• Coordinate internal and external embargoes across customers, engineering teams, and maintainers.
• Coordinate vulnerability actions with the Linux Foundation, CISA, and other industry bodies.

What you'll need

• 7+ years of experience in software security, open source maintenance, or vulnerability disclosure management.
• Strong understanding of responsible disclosure.
• Practical expertise automating pipelines and processes at large scale.
• Deep experience with open source communities.
• Experience coordinating with public-sector or industry standards bodies and working groups.

Nice to have

• Thought leadership in vulnerability disclosure management and embargoes.
• Familiarity with minimal or hardened container base image ecosystems.
• Experience operating a CNA.
• Software engineering experience in Python, Java, JavaScript, Go, or similar languages.
• Background in security research, penetration testing, or bug bounties.

Details

• Location: Canada.
• Work mode: Remote.
• Individual-contributor Staff role.