Vulnerability Management Engineer

Workstreet; India; Remote; INR 900,000 - 1,500,000; Full time

Benefits offered by this job

Career Development

Technical Training

Competitive Base Salary

Growth Opportunity

Remote-First Culture

Job summary

Workstreet is hiring a Vulnerability Management Engineer to advise fast‑growth startups and hands‑on fix security gaps in applications, code, and delivery pipelines. You will triage, prioritize, and drive fixes using Dependabot, code scanning, and infrastructure‑as‑code tools across client projects.

Join a delivery‑driven team that emphasizes risk‑based prioritization, detailed guidance, and a strong client relationship mindset to close gaps within 30 days where possible.

Qualifications

• Hands-on vulnerability triage and remediation in web apps and dependencies.
• Experience with GitHub Dependabot and GitHub Advanced Security (SCA/SAST).
• Ability to use CVSS, EPSS, CISA KEV to rank findings and communicate risk.
• Experience with containers, CI/CD pipelines, Terraform and cloud platforms.
• Ability to map remediation to SOC 2, ISO 27001, HIPAA, CMMC audits.

Responsibilities

• Triage and prioritize code vulnerabilities from Dependabot, code scans, and secret scanning.
• Own remediation pull requests and guide fixes in collaboration with engineers.
• Configure and tune scanning coverage across GitHub orgs and pipelines.
• Remediate findings in base images, workflows, and Terraform-defined infra.
• Document exceptions, track evidence, and support audit readiness.
• Serve as primary security advisor and manage client-facing deliverables.

Tools

GitHub Actions

Terraform

Wiz

Vanta

Nessus/Qualys

Job description

At Workstreet, we're on an exciting journey to help businesses scale securely by designing and implementing cutting‑edge security and compliance programs. As a fast‑growing startup, we specialize in a wide range of GRC (governance, risk, and compliance) services that support frameworks across SOC 2, ISO 27001, GDPR, CMMC, NIST 800-171, NIST 800-53, and FedRAMP. We empower companies to meet regulatory requirements and enhance their cybersecurity posture from day one.

Get to Know the Vulnerability Management Team

Our Vulnerability Management team does not stop at the report. We identify, prioritize, and fix vulnerabilities hands‑on across client environments, with a focus on the web applications and code our clients ship. We work closely with client engineering, DevOps, and security teams to move findings from open to closed as efficiently as possible, using risk‑based prioritization to make sure the right things get fixed first.

The Opportunity

We are seeking a consultative and hands‑on Vulnerability Management (VM) Engineer to join our Delivery team. You will serve as the primary security advisor for an assigned portfolio of fast‑growth startups, helping them identify, prioritize, and fix risks in their applications, code, and delivery pipelines.

In this role, you will combine hands‑on work in client code repositories with high‑touch client advisory. Using GitHub Dependabot, GitHub Advanced Security (code scanning with CodeQL, and secret scanning), Vanta, container and infrastructure‑as‑code scanners such as Wiz, and risk prioritization models (CVSS, EPSS, and the CISA Known Exploited Vulnerabilities catalog), you will surface the vulnerabilities that matter. Instead of passing findings along, you will triage them, open and review the pull requests that fix them, and work directly with client engineering and DevOps teams to get those fixes merged and deployed. If you want to be the person who closes the loop from alert to merged fix, this is your team.

What You'll Do

• Triage and Prioritize Code Vulnerabilities: Work through Dependabot alerts, code scanning results, and secret scanning alerts across client repositories. Determine whether a vulnerable package or code path is reachable and exploitable in the client's application, dismiss false positives with documented rationale, and rank findings using CVSS, EPSS, CISA KEV status, and the client's asset and data context.
• Own Remediation Pull Requests: Review, test, and merge Dependabot pull requests, and open your own for upgrades Dependabot cannot handle, such as transitive dependencies, major version bumps, and breaking changes. Apply straightforward code and configuration fixes directly, and give engineers clear written guidance on fixes that need design changes. Work with client engineers through code review and release processes to meet a sub‑30‑day time‑to‑remediate target.
• Configure and Maintain Scanning Coverage: Enable and tune Dependabot, code scanning, and secret scanning across client GitHub organizations, including repository coverage, alert rules, update grouping, and ignore rules. Maintain scanning of container images, CI/CD pipelines, and Terraform using tools such as Wiz, and connect findings to Vanta so coverage gaps are visible.
• Remediate Pipeline, Container, and Infrastructure Findings: Fix vulnerabilities in base images, GitHub Actions workflows and other CI/CD configuration, and Terraform‑defined infrastructure by changing the code rather than the console. Where required, deploy patches to systems hosted in AWS, Azure, and GCP.
• Manage Exceptions and Audit Evidence: Document, verify, and track client requests for temporary vulnerability exceptions and long‑term risk acceptances, including dismissed alerts and accepted dependency risks. Map remediation data, such as alert history, pull request records, and time‑to‑remediate metrics, to the control evidence required for SOC 2, ISO 27001, HIPAA, CMMC, and NIST audits.
• Own the Advisory Client Experience: Act as the primary point of contact and trusted security advisor for an assigned portfolio of fast‑growth startups. Deliver regular project milestones, handle high‑priority technical escalations with calm professionalism, and produce status reports and executive summaries that communicate technical risk as business value.

Who You Are

• Application vulnerability engineer: You have hands‑on experience triaging and remediating vulnerabilities in web applications and their dependencies, and you have worked with GitHub Dependabot and GitHub Advanced Security, or with comparable software composition analysis (SCA) and static analysis (SAST) tools.
• Risk prioritizer: You use CVSS base scores, EPSS exploit probability, CISA KEV, and reachability analysis to decide what gets fixed first, and you can explain the ranking to a founder or engineering lead.
• Precision threat analyst: You validate scanner output, eliminate false positives, and understand common web vulnerability classes, including injection, cross‑site scripting, server‑side request forgery, and broken access control, well enough to judge whether a finding is real.
• Pipeline and infrastructure security practitioner: You have worked with containers, CI/CD pipelines (GitHub Actions or similar), and Terraform, and you can find and fix vulnerabilities and misconfigurations in each.
• GRC‑aware engineer: You can match continuous monitoring and remediation records to audit evidence requirements for SOC 2, ISO 27001, HIPAA, and CMMC.
• Technical consultant: You write clear technical guidance, structure project milestones and progress tracking, and manage deliverables across an active portfolio of client accounts at once.
• Stakeholder diplomat: You build trust quickly with US‑based tech founders, engineering leaders, and executives, and you communicate technical risk in business terms.

What Will Help You Succeed

• Patch and dependency management at scale: A track record managing dependency upgrades, change management, and remediation sequencing alongside distributed engineering, DevOps, and IT teams, ideally in a managed service provider (MSP/MSSP) or consulting environment.
• Professional certifications: Active credentials such as CompTIA Security+, CEH, GIAC GEVA, GIAC GWEB, AWS Certified Security - Specialty, or Microsoft SC‑200.
• Cloud‑native security experience: Direct experience mapping, configuring, and defending workloads on AWS, GCP, and Azure.
• Vulnerability intelligence: Working knowledge of the CVE lifecycle, the National Vulnerability Database (NVD), the GitHub Advisory Database, OSV, and CISA KEV, and how advisories become fixes in package ecosystems.
• Network and host scanner experience: Familiarity with Tenable/Nessus, Qualys, or Rapid7 InsightVM, which some clients use alongside code and cloud scanning.

What We Offer

• Career Development: Clear path with mentorship and training opportunities
• Technical Training: Comprehensive onboarding on security and compliance frameworks
• Competitive Compensation: A competitive base salary with regular performance reviews linked to merit‑based appraisals and bonus opportunities.
• Growth Opportunity: Early‑stage company with significant room for career advancement.
• Remote‑First Culture: Flexibility to work from anywhere while collaborating with a global team.

What You'll Need to Thrive

• Excellent written and verbal English communication skills, with the ability to engage confidently with clients, engineering teams, and business leaders across global teams.
• A reliable, high‑speed internet connection and a professional home office environment that supports confidential conversations, virtual meetings, and uninterrupted collaboration.
• Commitment to working a standard schedule of 8:00 AM to 5:00 PM US Eastern Time (ET) to effectively support clients and cross‑functional teams. Occasional flexibility to adjust working hours is expected to accommodate changing business priorities, global collaboration, and time‑sensitive remediation needs.
• Willingness and ability to travel locally for occasional onsite meetings, team gatherings, or business activities as needed.

Hiring and Selection Process

• Candidates must participate in live video interviews throughout the hiring process with the camera on (non‑negotiable) and be prepared to verify their identity during recruitment and onboarding.
• Employment is contingent upon successful completion of identity verification and background screening, where permitted by law.
• Selected candidates will participate in structured interviews with hiring managers and cross‑functional stakeholders to assess role fit, experience, and alignment with Workstreet's operating principles.
• Candidates will receive prompt updates and consistent communication throughout the interview process, ensuring a transparent, smooth, and engaging experience at every step.

Workstreet Is an Equal Opportunity Employer

As an equal opportunity employer, Workstreet is committed to providing employment opportunities to all individuals. All applicants for positions at Workstreet will be treated without regard to race, color, ethnicity, religion, sex, gender, gender identity and expression, sexual orientation, national origin, disability, age, marital status, veteran status, pregnancy, or any other basis prohibited by applicable law. Employment with Workstreet is contingent upon the successful completion of a background check, which may include verification of employment history, education, and other relevant information, in compliance with applicable laws.