Principal Cyber Vulnerability Engineer Dallas or Detroit metro

Comerica; Hoschton (GA); On-site; USD 150,000 - 210,000; Full time

Job summary

Comerica is seeking a Principal Cyber Vulnerability Engineer to lead vulnerability assessments and remediation efforts across applications and infrastructure. You will partner with AppSec and VM Ops teams, drive automation, and develop metrics and reporting while guiding cross-functional teams and vendors to reduce risk.

The role requires hands-on vulnerability management expertise, experience with Qualys and VMDR, and programming knowledge to automate processes.

Qualifications

• Bachelor’s degree in Computer Science, Engineering, Information Systems, Cybersecurity, or Business Administration, or equivalent experience.
• 12+ years of relevant experience or equivalent education/work experience.
• 6+ years in Cyber/Security, preferably Vulnerability Management in financial services.
• 5+ years collaborating across Enterprise IT and Security to remediate vulnerabilities.
• 3+ years programming concepts (Python, .NET, Java, JavaScript) with automation.
• 3+ years in Qualys Policy management, PCI Compliance, VMDR modules.
• 2+ years in vulnerability assessments and cloud platform exposure management.

Responsibilities

• Perform vulnerability assessments and baseline scans; report on KRIs.
• Lead vulnerability management and remediation activities with owners.
• Establish mature processes around remediation and reporting.
• Lead projects like vulnerability prioritization to remediate critical issues.
• Evaluate vendors for vulnerability management products and support deployments.
• Develop metrics to track enterprise risks and remediation trends; report to management.
• Support monthly KRI reporting and remediation efforts across teams.
• Automate manual processes to improve delivery speed.
• Coach junior team members and application teams on remediation.

Skills

Vulnerability management

Automation

Cross-functional collaboration

Mentoring

Programming concepts

Security reporting/metrics

Cloud vulnerability management

Education

Bachelor’s degree

Equivalent experience

Tools

Qualys

VMDR

PowerBI

PowerShell

Endpoint protection technologies

Job description

Principal Cyber Vulnerability Engineer

The Cyber Vulnerability Operations Team consists of the Application Security (AppSec) teams and the Vulnerability Management Operations (VM Ops) teams. Together, the Vulnerability Operations team collaborates with peers across Comerica to provide visibility into vulnerabilities within applications and infrastructure and ensures they are remediated, as well as facilitates and enforces the use of secure development practices across the bank.

The Principal Cyber Vulnerability Operations Engineer is responsible for vulnerability scanning, prioritizing vulnerabilities, and driving remediations while partnering with the application and infrastructure teams. The ideal candidate will have hands‑on expertise in vulnerability management and operations, knowledge of tools such as Qualys and PowerBI, experience with Windows/Linux/Unix server administration, and coding in one programming language. Experience with cross‑functional teams and automation is required. A background in Qualys Policy management, PCI Compliance, and VMDR modules is also critical.

Position Responsibilities

• Perform vulnerability assessments and baseline control scans across the Comerica environment; report on Key Risks Indicators (KRIs).
• Lead security vulnerability and risk management activities, identifying vulnerabilities and supporting application/system owners to manage risks and remediate vulnerabilities.
• Establish and mature processes around vulnerability management, remediation, and reporting.
• Lead key projects such as vulnerability prioritization to remediate critical vulnerabilities.
• Participate in vendor evaluations and selection for vulnerability management products, including external attack surface management solutions; implement and support those products on an ongoing basis.
• Stay current on vulnerability management best practices across the industry.
• Develop a comprehensive set of metrics to track enterprise risks and remediation trends; keep management informed through accurate, timely reporting.
• Support monthly KRI reporting by collecting data and working with application and infrastructure teams to remediate vulnerabilities.
• Create presentations based on KRI materials and keep management informed.
• Drive technical excellence and implementation of vulnerability management best practices in collaboration with technology teams across the enterprise.
• Provide consultation and close collaboration with other infrastructure departments and vendors to meet organizational and business goals.
• Automate existing manual processes to improve delivery speed.
• Coach and mentor junior team members and application teams on vulnerability remediation efforts.
• Identify and communicate gaps in vulnerability management practices.
• Participate in Red Team exercises to proactively identify potential vulnerabilities.
• Partner with application and infrastructure owners to provide consulting on remediation of large, complex vulnerabilities within SLAs, reducing risk for the bank.
• Develop cyber vulnerability analysis and related metrics and reporting deliverables.

Position Qualifications

• Bachelor’s Degree in Computer Science, Engineering, Information Systems, Cybersecurity, or Business Administration, or equivalent experience.
• 12 years of relevant experience or higher education and work experience equivalent.
• 6+ years of experience in Cyber or Information Security, preferably in Vulnerability Management and Security within the financial services industry.
• 5+ years of experience collaborating across Enterprise IT and Security to remediate vulnerabilities identified.
• 3+ years of experience with programming concepts and fundamentals (e.g., Python, .NET, Java, JavaScript, PowerShell) and ability to automate with those tools.
• 3+ years of experience in Qualys Policy management, PCI Compliance, and VMDR modules.
• 3+ years of experience or working knowledge in server administration.
• 2+ years of experience coaching/mentoring contractors.
• 2+ years of experience in vulnerability assessments, including creation, maintenance, and troubleshooting of scan configurations across the enterprise.
• 2+ years of experience with Vulnerability Management across cloud platforms and EVM management/prioritization.
• 2+ years of experience with endpoint protection technologies.

Location: Auburn Hills Operations Center

Hours: 8:00am – 5:00pm Monday–Friday