Senior Security Vulnerability Engineer

Jobtailor; Colombia; Presencial; COP 12.000.000 - 24.000.000; Jornada completa

Descripción de la vacante

Jobtailor in Colombia seeks an senior cybersecurity leader to own the vulnerability management lifecycle, from scanning to remediation, and to drive risk‑based prioritization across cloud and on‑prem environments.

You will leverage AI to accelerate patching and configuration changes, optimize the platform for scalable coverage, and report executive metrics to leadership. Collaboration with IT, Security, and compliance is essential.

Formación

• Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
• 8+ years in cybersecurity with at least 3 years in vulnerability or risk management in a SaaS environment.
• Hands-on expertise with vulnerability management platforms such as Wiz, Tenable, Qualys, Rapid7, Vulcan, or Kenna.
• Strong command of CVSS, patch management, remediation SLA management, and risk-based prioritization.
• Solid understanding of operating systems, networking, and major cloud platforms (AWS, Azure, GCP).
• Knowledge of CSPM/CNAPP platforms and cloud security best practices.

Responsabilidades

• Own and advance the vulnerability management lifecycle from scanning to remediation.
• Leverage AI to automate patches and configuration changes for rapid exploit resolution.
• Optimize the vulnerability platform for scalable, automated coverage across IT and cloud.
• Develop executive metrics and reporting on vulnerability posture for leadership.
• Apply risk-based prioritization using CVSS and criticality to determine remediation urgency.
• Collaborate with Red Team, IT, Engineering, SRE, and Compliance to mitigate cloud risks.
• Manage scanning exemptions and vulnerability exceptions through their lifecycle.
• Drive visibility and remediation of cloud misconfigurations and over-permissions.

Conocimientos

Vulnerability management

Risk management

Cloud security

CVSS / risk scoring

Platform familiarity

Educación

Bachelor's degree in CS / Info Security or related field

Herramientas

Wiz

Tenable

Qualys

Rapid7

Vulcan

Kenna

Descripción del empleo

Responsibilities

• Own and advance the enterprise vulnerability management lifecycle — scanning, triage, risk scoring, remediation tracking, validation, and continuous improvement.
• Leverage AI systems to automate patches and configuration changes, driving toward near real‑time exploit resolution.
• Optimize the vulnerability management platform for accurate, automated, and scalable coverage across infrastructure, applications, and cloud environments.
• Develop executive‑level metrics and reporting to drive accountability and communicate vulnerability posture to leadership.
• Apply a risk‑based prioritization model using CVSS, system criticality, threat intelligence, and compensating controls to determine remediation urgency.
• Partner cross‑functionally with Red Team, IT, Engineering, SRE, and Compliance to identify and mitigate risks tied to end‑of‑life systems and cloud‑native vulnerabilities.
• Manage scanning exemptions and vulnerability exceptions through their full lifecycle, including documentation, justification, and remediation tracking.
• Drive visibility and remediation of cloud misconfigurations, exposed services, and over‑permissioned identities across the organization.

Requirements

• Bachelor's degree in Computer Science, Information Security, or a related field — or equivalent practical experience.
• 8+ years in cybersecurity, with at least 3 years focused on vulnerability management or risk management in a SaaS environment.
• Hands‑on expertise with vulnerability management platforms such as Wiz, Tenable, Qualys, Rapid7, Vulcan, or Kenna.
• Strong command of CVSS, patch management, remediation SLA management, and risk‑based prioritization.
• Solid understanding of operating systems (Windows, Linux, macOS), networking, and major cloud platforms (AWS, Azure, GCP).
• Experience with CSPM/CNAPP platforms such as Wiz, Prisma Cloud, or Orca.
• Excellent analytical and communication skills with a track record of influencing stakeholders at all levels.
• Nice if you have: Experience with container security and cloud‑native environments (Docker, Kubernetes, serverless).
• Knowledge of security frameworks such as NIST CSF, PCI DSS, SOC 2, or ISO 27001.
• Experience automating remediation workflows or integrating vulnerability data into Jira or ServiceNow.
• Relevant certifications: CISSP, CISM, OSCP, GIAC/GVMS, or cloud security certifications.