Threat-Driven Vulnerability Engineer

Backblaze External Website; Colombia; Remote; COP 381,934,000 - 572,902,000; Full time

Job summary

Backblaze is seeking a Vulnerability Management Engineer to drive risk-based vulnerability and exposure management across infrastructure, applications, cloud services, endpoints, and software dependencies.

You will combine vulnerability data, asset and configuration intelligence, application-security testing, threat intelligence, and AI-assisted analysis to determine reachability and imminence of threats.

Qualifications

• Experience with enterprise vulnerability or exposure management.
• Strong understanding of infrastructure, applications, cloud, containers, networking, and software dependencies.
• Experience interpreting vulnerability intelligence and assessing practical exploitability.
• Knowledge of risk-based prioritization techniques including CVSS, exploit prediction, known-exploitation intelligence, and environmental context.
• Experience correlating vulnerability, asset, configuration, SAST, DAST, SCA, endpoint, or related security data.
• Experience with scripting, automation, or data analysis.
• Familiarity with continuous exposure management, attack-path analysis, AI-assisted analysis, or automated mitigation is preferred.
• Strong understanding of OWASP Top 10, MITRE ATT&CK, MITRE D3FEND, and STRIDE.
• Familiarity with OWASP Top 10 for LLM, OWASP Top 10 for Agentic Applications, MITRE ATLAS and MAESTRO.

Responsibilities

• Correlate threat intelligence and vulnerability findings with asset inventory, software configuration, system configuration, application testing, network exposure, ownership, and business criticality.
• Assess exploitability and reachability rather than relying on vulnerability severity alone.
• Incorporate exploit prediction, known exploitation, open-source threat intelligence, adversary activity, and environmental context into prioritization.
• Determine whether exposure requires immediate incident response or remediation under established operational objectives.
• Use AI-assisted workflows to ingest and correlate vulnerability intelligence against the organization’s actual technology configuration while independently validating conclusions.
• Partner with Red Team to validate practical exploitability of significant vulnerabilities.
• Identify compensating controls such as configuration changes, access restrictions, segmentation, or filtering when immediate patching is impractical.
• Automate vulnerability ingestion, analysis, prioritization, remediation tracking, mitigation, and verification where appropriate.

Skills

Vulnerability management

Cloud & containers

Threat intel

Exploitability assessment

Scripting/automation

AI-assisted analysis

OWASP Top 10, MITRE ATT&CK

Tools

SAST

DAST

SCA

Job description

Backblaze is seeking a Vulnerability Management Engineer to drive risk-based vulnerability and exposure management across infrastructure, applications, cloud services, endpoints, and software dependencies.

You will combine vulnerability data, asset and configuration intelligence, application-security testing, threat intelligence, and AI-assisted analysis to determine reachability and imminence of threats.