Remote Vulnerability & Risk Engineer

WebHosting; Colombia; Remote; COP 284,765,000 - 411,327,000; Full time

Job summary

Backblaze is seeking a Vulnerability Management Engineer to drive risk-based vulnerability and exposure management across infrastructure, applications, cloud services, endpoints, and software dependencies. The role blends vulnerability data, asset and configuration intelligence, application-security testing, threat intelligence, and AI-assisted analysis to determine reachability and exploitable threats.

Key responsibilities include correlating threat intel with assets, prioritizing based on

Responsibilities

• Correlate threat intelligence and vulnerability findings with asset inventory, software configuration, system configuration, application testing, network exposure, ownership, and business criticality.
• Assess exploitability and reachability rather than relying on vulnerability severity alone.
• Incorporate exploit prediction, known exploitation, open-source threat intelligence, adversary activity, and environmental context into prioritization.
• Determine whether exposure requires immediate incident response or remediation under established operational objectives.
• Use AI-assisted workflows to ingest and correlate vulnerability intelligence against the organization’s actual technology configuration while independently validating conclusions.
• Partner with Red Team to validate practical exploitability of significant vulnerabilities.
• Identify compensating controls such as configuration changes, access restrictions, segmentation, or filtering when immediate patching is impractical.
• Automate vulnerability ingestion, analysis, prioritization, remediation tracking, mitigation, and verification where appropriate.

Job description

Backblaze is seeking a Vulnerability Management Engineer to drive risk-based vulnerability and exposure management across infrastructure, applications, cloud services, endpoints, and software dependencies. The role blends vulnerability data, asset and configuration intelligence, application-security testing, threat intelligence, and AI-assisted analysis to determine reachability and exploitable threats.

Key responsibilities include correlating threat intel with assets, prioritizing based on