Qualys SME

DataDrone Inc.; Cheyenne, Northern (WY, KY); Hybrid; USD 100,000 - 160,000; Full time

Job summary

DataDrone Inc. is seeking a hands-on Qualys deployment architect to design, tune, and deliver a scalable Qualys environment for mid-market clients. You will craft asset models, write scan policies, and ship a deployment that clients can extend after Day 45.

You will integrate with ServiceNow, Splunk, Sentinel, and Jira, ensuring audit-ready evidence and robust documentation throughout. Strong cloud experience (AWS/Azure/GCP) and API-driven configuration are required.

Qualifications

• Deep, hands-on Qualys depth across the suite - VMDR as primary, with working knowledge of CSAM, WAS, and TotalCloud.
• Strong scan design instincts - sensitivity to false-positive cost, scan window logic, authentication health monitoring.
• Documentation-first habit - nothing lives in tribal knowledge; every architectural decision is written down as you make it.
• Comfort with cloud platforms (AWS, Azure, GCP) and the Cloud Agent deployment story across heterogeneous OSs.
• Ability to operate in a co-pilot rhythm - the client team is in every architectural call; you advise, they decide.
• Tooling fluency: Qualys API for bulk operations, version control for config exports, and modern documentation surfaces.

Responsibilities

• Own Qualys platform design through Day-7 baseline - Requirements Pack Section 3 signed.
• Build scan policy libraries across VMDR, CSAM, WAS, TotalCloud, Policy Compliance, and Cloud Agent (as scoped per engagement).
• Define asset tagging and grouping strategy reconciled against the client's CMDB or source of truth.
• Configure authentication records and credential rotation discipline (the single most common silent-failure mode in Qualys).
• Build dashboards for SecOps, Compliance, and Executive audiences - walked through with each audience before declaring done.
• Activate Policy Compliance phased, tune findings between phases, and deliver audit-ready evidence packages.
• Co-pilot the named client VM Program Owner through a full scan cycle before Day 45, so the handover is real.
• Write configuration documentation that a competent client engineer could rebuild the deployment from, with zero context.

Job description

DataDrone runs a Qualys implementation practice that ships outcomes in 45 days. Not a license shop. Not a generalist consultancy. Every engagement starts with one Hero use case and ends with the client team running a Qualys deployment they actually trust - at mid-market and lower-enterprise, where Qualys's value gets stranded most often.

This role is the technical anchor. The person whose hands shape the Qualys deployment that the client will live in. The seat of the practice cannot be wrong.

What You'll Do

You design the deployment. You write the scan policies. You tune the platform until the findings carry a signal. You build the dashboards each audience trusts. You hand over a Qualys subscription that runs like a machine - not because we polished it, but because we built it right.

You sit at the center of every engagement. The Engagement Manager runs the rhythm; the Integration Engineer wires Qualys to the outside (ServiceNow, Splunk, Sentinel, Jira); QA & Validation verifies what you ship; the Sales & Account Executive owns the commercial surface. You hold the technical line.

You will not be doing forklift configuration or building monuments to your own sophistication. You will be designing the asset model that actually reflects the client's environment, writing scan policies that produce signal instead of noise, and shipping a deployment that the client's team can extend on Day 46 - without you.

Daily Rhythm (How You Operate)

• Morning stand-up with the POD, midday hands-on configuration block (phone off), end-of-day decisions logged. Architecture written down in the same hour you make it.
• Sandbox-first, always. Production changes go through a QA gate. Configuration Reference updated end-of-day, every build day. No exceptions.
• Cultural maxim: "Design before build. Maintainability over cleverness. The deployment we ship is the deployment the client operates after Day 45."
• Timezone Flexibility - clients pick NA / EMEA / APAC; we mirror.

Key Responsibilities

• Own Qualys platform design through Day-7 baseline - Requirements Pack Section 3 signed.
• Build scan policy libraries across VMDR, CSAM, WAS, TotalCloud, Policy Compliance, and Cloud Agent (as scoped per engagement).
• Define asset tagging and grouping strategy reconciled against the client's CMDB or source of truth.
• Configure authentication records and credential rotation discipline (the single most common silent-failure mode in Qualys).
• Build dashboards for SecOps, Compliance, and Executive audiences - walked through with each audience before declaring done.
• Activate Policy Compliance phased, tune findings between phases, and deliver audit-ready evidence packages.
• Co-pilot the named client VM Program Owner through a full scan cycle before Day 45, so the handover is real.
• Write configuration documentation that a competent client engineer could rebuild the deployment from, with zero context.

What We're Looking For

• Deep, hands-on Qualys depth across the suite - VMDR as primary, with working knowledge of CSAM, WAS, and TotalCloud.
• Strong scan design instincts - sensitivity to false-positive cost, scan window logic, authentication health monitoring.
• Documentation-first habit - nothing lives in tribal knowledge; every architectural decision is written down as you make it.
• Comfort with cloud platforms (AWS, Azure, GCP) and the Cloud Agent deployment story across heterogeneous OSs.
• Ability to operate in a co-pilot rhythm - the client team is in every architectural call; you advise, they decide.
• Tooling fluency: Qualys API for bulk operations, version control for config exports, and modern documentation surfaces.

Bonus Points For

• Certifications in any compliance framework you've configured (PCI, SOC 2, HIPAA, FedRAMP, ISO 27001).
• Experience migrating off another VM platform (Rapid7 InsightVM, Tenable, Nessus) - the parallel-run discipline matters.
• Past contribution to a partner practice's pattern library - scan policy templates, dashboard libraries, runbook collections.

The Mindset We Hire For

• Design before build. Sophistication that the client can't maintain is technical debt we sold them.
• Co-pilot, never contractor. The client team is in every architectural conversation. We decide with them.
• Documentation is the deliverable. If it lives in your head, it's fragile.
• Signal over noise. A tuned platform is the contract. A noisy queue is a broken queue.
• The handover is the test. If the client can't run it on Day 46, we didn't ship.
• Honesty over polish. Gaps get documented and owned, not papered over.

Success in This Role

• 30 days: POD rhythm internalized; one engagement underway with sharp configuration discipline.
• 60 days: First engagement closed and handed off cleanly; warranty window clean.
• 90 days: Second engagement underway with pattern-library contributions back to the practice.

Tools You'll Use

Qualys console (VMDR, CSAM, WAS, TotalCloud, Policy Compliance, Cloud Agent), Qualys API, scanner appliances (virtual + physical), Cloud Agent deployment tooling (Intune, JAMF, Ansible, SCCM per client), Git for config-export version control, modern documentation surfaces (Confluence / Notion / Google Docs), the practice's AI Copilot loaded with the Qualys practice KB.

Why Join Us

You're not building Qualys deployments as a checkbox for a reseller - you're shipping deployments the client owns and runs forever after. The practice rewards clarity over cleverness, co-piloting over contracting, and the handover discipline most VM programs never get.

You pick where you land on the clock - NA / EMEA / APAC - and we mirror. Timezone Flexibility is built into the practice; you don't fit yourself into someone else's day.

Self-Check Before You Apply

• I write down architectural decisions in the same hour I make them.
• I'd rather ship a maintainable deployment than a sophisticated one.
• I check the auth failure rate weekly without being asked.
• I run the handover with the client driving, not me.
• I treat the top-severity queue as a contract with the client team - if it's noisy, I've not shipped.
• I document gaps honestly rather than paper over them.