Senior Vulnerability Management Engineer

Cpl Group; Dublin; On-site; EUR 111,000 - 166,000; Full time

Job summary

Autodesk is seeking a Senior Vulnerability Management Engineer to own and operate the CE+ vulnerability program. This remote contractor role focuses on authenticated scanning, SLA-driven remediation, and evidence pipelines to demonstrate control effectiveness to assessors and leadership.

The role collaborates across Trust Compliance, Device Trust, Networking, and asset owners to scale VM across endpoints, data centers, and cloud workloads, extending beyond CE+ into broader enterprise scope.

Qualifications

• 7+ years of experience in vulnerability management, security engineering, or related roles.
• Hands-on experience with enterprise VM platforms (Defender VM, Qualys, Tenable, or Rapid7).
• Strong understanding of CVSS scoring, prioritization, and remediation lifecycle.
• Experience producing audit evidence for CE+, SOC 2, ISO 27001, PCI, or equivalent.
• Ability to partner with auditors, assessors, or regulators in a technical capacity.

Responsibilities

• Own end-to-end vulnerability management for CE+ in-scope assets — endpoints, servers, and supporting infrastructure.
• Configure and operate authenticated vulnerability scanning across Windows, macOS, Linux, and cloud workloads.
• Define and enforce SLA logic aligned to CE+ v3.3 — Critical/High vulnerabilities remediated within 14 days.
• Build and own the continuous evidence pipeline — scan coverage reporting, SLA dashboards, lifecycle audit trails, attestation packs.
• Own the exception register — document risk-accepted items with compensating controls and remediation roadmaps.
• Partner with CE+ assessors during certification cycles; serve as the technical voice defending control effectiveness.
• Coordinate remediation across Device Engineering, Device Trust, Networking, and business asset owners.
• Integrate findings with ITSM workflows for auto-ticketing, ownership, and SLA tracking.
• Contribute to broader enterprise vulnerability and patch management strategy as scope expands.
• Support adjacent compliance frameworks by leveraging VM evidence foundation.

Skills

Vulnerability management

Security engineering

Audit readiness

Cross-functional collaboration

Automation scripting

Tools

Microsoft Defender Vulnerability Management

Qualys

Tenable

Rapid7

Job description

Senior Vulnerability Management Engineerurgent Daily Rate remote contractor required to build and operate the vulnerability management program supporting Cyber Essentials Plus (CE+) certification and broader enterprise compliance objectives. This role is the technical owner of authenticated vulnerability scanning, SLA-driven remediation coordination, and the continuous evidence pipeline required to demonstrate ongoing control effectiveness to assessors and executive leadership.

This is a strategic, audit-facing role that combines deep technical execution with cross-functional partnership across Trust Compliance, Device Trust, Networking, and asset owners across Autodesk. The successful candidate will establish the foundation for a vulnerability management capability that scales beyond CE+ into Network, Data Center, and Cloud Infrastructure scope.

Responsibilities

• Own end-to-end vulnerability management for CE+ in-scope assets — endpoints, servers, and supporting infrastructure
• Configure and operate authenticated vulnerability scanning across Windows, macOS, Linux, and cloud workloads
• Define and enforce SLA logic aligned to CE+ v3.3 — Critical/High vulnerabilities (CVSS ≥7.0) remediated within 14 days
• Build and own the continuous evidence pipeline — scan coverage reporting, SLA compliance dashboards, vulnerability lifecycle audit trails, and quarterly attestation packs
• Own the exception register — document risk-accepted items with compensating controls, named risk owners, and remediation roadmaps
• Partner directly with CE+ assessors during certification and recertification cycles; serve as the technical voice defending control effectiveness
• Coordinate remediation across Device Engineering, Device Trust, Networking, and business asset owners
• Integrate vulnerability findings with ITSM workflows to ensure auto-ticketing, ownership assignment, and SLA tracking
• Contribute to broader enterprise vulnerability and patch management strategy as scope expands into Network, Data Center, and Cloud Infrastructure
• Support adjacent compliance frameworks by leveraging the VM evidence foundation

Minimum Qualifications

• 7+ years of experience in vulnerability management, security engineering, or related roles
• Hands-on experience operating enterprise vulnerability management platforms (Microsoft Defender Vulnerability Management, Qualys, Tenable, or Rapid7)
• Strong understanding of CVSS scoring, vulnerability prioritization, and remediation lifecycle management
• Experience producing audit evidence for compliance frameworks (CE+, SOC 2, ISO 27001, PCI, or equivalent)
• Demonstrated ability to partner with auditors, assessors, or regulators in a technical capacity
• Strong cross-functional collaboration skills — comfortable working with compliance, engineering, networking, and business stakeholders
• Familiarity with endpoint management platforms and identity platforms
• Experience scaling vulnerability management programs across endpoint, network, data center, and cloud scope

Preferred Qualifications

• Direct experience with Cyber Essentials Plus or comparable UK/EU certification schemes
• Experience with Microsoft Defender for Endpoint and Defender Vulnerability Management at scale
• Familiarity with patch management platforms
• Experience building security evidence dashboards using Power BI, Splunk, or equivalent
• Scripting and automation skills (PowerShell, Python, KQL)
• Industry certifications: GIAC GCIH, GCED, GPEN, CISSP, or equivalent