Security Engineer - Vulnerability & Exposure Management

Roche Holding AG; Petaling Jaya; On-site; MYR 368,000 - 613,000; Full time

Job summary

Roche Holding AG is seeking a Security Engineer within the MIR team to protect networks, systems, and users from evolving cyber threats. You will identify, assess, prioritize, and reduce cybersecurity risks across Roche’s global environment.

Join a collaborative, highly technical cybersecurity team that values innovation, curiosity, continuous learning, and proactive risk reduction. You will engineer automation and remediation workflows to strengthen Roche’s security posture.

Qualifications

• Associate degree or 5+ years of information security experience.
• Experience triaging, analyzing, and escalating security vulnerabilities.
• Strong understanding of web app, network, endpoint and cloud security concepts.
• Scripting or programming in Python/JavaScript/Node.js with security tooling.

Responsibilities

• Triage, investigate, and respond to critical vulnerabilities.
• Evaluate and prioritize vulnerabilities identified through security tools and bug bounty programs.
• Research emerging threats and assess exploitability against Roche’s attack surface.
• Collaborate with infrastructure, cloud, application, and security teams to drive remediation.
• Develop scripts, detection logic, templates, and automation workflows to improve efficiency.
• Contribute to security monitoring and incident response in a global environment.

Skills

Python

JavaScript

Node.js

Education

Associate degree

Tools

Security tooling

Job description

Chez Roche, vous pouvez être vous-même et être apprécié pour les qualités uniques que vous apportez. Notre culture encourage l'expression personnelle, le dialogue ouvert et les connexions authentiques, où vous êtes valorisé, accepté et respecté pour ce que vous êtes, vous permettant de prospérer tant personnellement que professionnellement. Voici comment nous visons à prévenir, arrêter et guérir les maladies et à garantir à chacun l'accès aux soins de santé aujourd'hui et pour les générations à venir. Rejoignez Roche, où chaque voix compte.

La position

The Global Security Monitoring & Incident Response (MIR) team at Roche is dedicated to protecting our networks, systems, applications, and users from constantly evolving cyber threats. As a Security Engineer within the Vulnerability & Exposure Management team, you will play a critical role in identifying, assessing, prioritizing, and reducing cybersecurity risks across Roche’s global environment.

This role goes beyond reviewing scanner outputs. You will help investigate critical vulnerabilities, assess exploitability, improve security tooling and automation capabilities, and partner with stakeholders globally to strengthen Roche’s security posture.

You will join a collaborative and highly technical cybersecurity team that values innovation, curiosity, continuous learning, and proactive risk reduction.

Your Opportunity

In this role, you will:

• Triage, investigate, and respond to critical vulnerabilities impacting Roche systems and applications

• Evaluate and prioritize vulnerabilities identified through security tools and external programs, including bug bounty initiatives

• Research emerging threats and assess exploitability against Roche’s attack surface

• Collaborate with infrastructure, cloud, application, and security teams to drive remediation activities

• Assess company systems and web applications using automated and manual testing approaches

• Engineer and enhance vulnerability scanning, detection, automation, and monitoring capabilities

• Contribute to security monitoring and incident response activities within a global environment
• Develop scripts, detection logic, templates, and automation workflows to improve operational efficiency
• Support continuous improvement initiatives across vulnerability and exposure management processes

Who you are

You bring a strong cybersecurity foundation combined with analytical thinking, technical curiosity, and a proactive approach to solving complex security challenges.

You also bring:

• Associate Degree in a relevant field or 5+ years of professional experience in information security, with demonstrated experience triaging, analyzing, and escalating security vulnerabilities
• Strong understanding of web application, network, endpoint, and cloud security concepts, including vulnerability management or attack surface management within complex enterprise environments
• Hands-on scripting or programming experience using languages such as Python, JavaScript, or Node.js, with familiarity in security tooling, detection logic, automation, or custom scripting
• Experience validating vulnerabilities, assessing exploitability, and supporting security monitoring or incident response activities
• Ability to communicate technical risks effectively to both technical and non-technical stakeholders, while balancing operational priorities and research initiatives
• Passion for cybersecurity, continuous learning, and emerging security trends, with exposure to open-source security projects or modern AI-assisted engineering workflows considered advantageous
• Professional fluency in English, with industry certifications related to offensive or application security (e.g., OSCP, GWAPT, OSWE) and enterprise cloud security experience viewed as strong assets

Qui nous sommes

Un avenir plus sain nous pousse à innover. Ensemble, plus de 100 000 employés à travers le monde sont dédiés à faire progresser la science et à garantir à chacun l'accès aux soins de santé aujourd'hui et pour les générations à venir. Nos efforts aboutissent à plus de 26 millions de personnes traitées avec nos médicaments et plus de 30 milliards de tests réalisés avec nos produits de Diagnostique. Nous nous encourageons mutuellement à explorer de nouvelles possibilités, à favoriser la créativité et à conserver nos grandes ambitions, afin de fournir des solutions de santé qui changent des vies et ont un impact mondial.

Construisons ensemble un avenir plus sain.

Roche est un employeur offrant l'équité en matière d'emploi.