Vulnerability Management Engineer

ASTEK SINGAPORE INNOVATION TECHNOLOGY PTE. LTD.; Singapore; On-site; SGD 70,000 - 100,000; Full time

Job summary

A technology solutions firm in Singapore is seeking a Vulnerability Management Engineer to oversee the full lifecycle of vulnerabilities. The successful candidate will lead vulnerability detection, analysis, and remediation, utilizing tools like OSS and SAST, and will need strong Python scripting skills. Experience in CI/CD environments and effective communication with stakeholders are essential for this role.

Qualifications

• Hands-on vulnerability management experience within CI/CD or SSDLC environments.
• Proficiency with vulnerability scanning tools and solid understanding of secure coding standards.
• Familiarity with established threat modeling techniques and tools.

Responsibilities

• Lead the end-to-end process from identification to remediation tracking.
• Embed vulnerability scanning capabilities within CI/CD and SSDLC workflows.
• Build and maintain automation scripts in Python to optimize processes.

Skills

Vulnerability management

CI/CD knowledge

Scripting in Python

Threat modeling

Communication skills

Education

Degree in Computer Science or Information Security

Tools

OSS

SAST

Container scanning tools

Job description

Role: Vulnerability Management Engineer

Overview

The Vulnerability Management Engineer will oversee the full lifecycle of vulnerabilities—detecting, analyzing, prioritizing, and driving remediation across the organization’s applications and infrastructure. This role requires strong technical knowledge of CI/CD pipelines, SSDLC practices, modern scanning technologies, and hands-on automation capabilities to enhance efficiency and coverage.

Key Responsibilities

• Vulnerability Lifecycle Ownership: Lead the end-to-end process from identification and triage to remediation tracking and final reporting, ensuring timely and effective resolution.
• Tool Integration & Operationalization: Embed and maintain vulnerability scanning capabilities within CI/CD and SSDLC workflows, including solutions for SAST, DAST, secret scanning, and container scanning.
• Automation Development: Build and maintain automation scripts—preferably in Python—to optimize scanning processes, data collection, analysis, and reporting dashboards.
• Root Cause & Risk Analysis: Evaluate vulnerabilities to determine underlying causes and recommend practical, long-term security controls.
• Threat Modeling: Conduct threat modeling sessions using system architecture diagrams and design documents to identify potential attack paths and security gaps.
• Cross-Team Collaboration: Work closely with engineering, infrastructure, DevOps, and risk teams to support remediation planning and reduce risk exposure.
• Clear Stakeholder Communication: Translate technical vulnerability details into clear, actionable insights for both technical and non-technical stakeholders, including explanations of business impact and mitigation strategies.
• Process Improvement: Continuously refine vulnerability management processes, metrics, and tools to strengthen overall security posture and operational efficiency.

Requirements

• Education: Degree in Computer Science, Information Security, or a relevant field.
• Experience: Hands-on vulnerability management experience within CI/CD or SSDLC environments.
• Technical Skills: Proficiency with vulnerability scanning tools such as OSS, SAST, and Container Scanning tools. Strong scripting and automation capability, especially using Python. Solid understanding of secure coding standards and common vulnerabilities, including the OWASP Top 10. Experience performing root cause analysis and developing realistic remediation strategies.
• Threat Modeling: Familiarity with established threat modeling techniques and tools.
• Soft Skills: Strong communication skills with the ability to present findings clearly to diverse stakeholders. Effective stakeholder management and the ability to influence remediation decisions.

Advantageous:

• Offensive security certifications such as OSCP, CEH, or GPEN.
• Experience managing vulnerabilities in large, complex enterprise environments.
• Knowledge of cloud-native security and securing containerized applications.