Security Engineer

CorSource; Oregon City (OR); On-site; USD 120,000 - 150,000; Full time

Job summary

CorSource is seeking an experienced Vulnerability Management professional to execute remediation across servers, endpoints, and network devices. You will drive triage, prioritization, and patching while coordinating with IT and vendor teams to meet SLA and regulatory timelines.

Ideal candidates have 3–5 years in vulnerability management, and hold Security+ with additional certifications. You will craft scalable remediation processes and maintain comprehensive audit evidence.

Qualifications

• Minimum of three to five years in vulnerability management or cybersecurity operations.
• CompTIA Security+ required; CySA+ or GIAC preferred.
• Experience in financial services or regulated industry preferred.
• Hands-on with patch and firmware remediation and tooling.

Responsibilities

• Execute remediation triage, prioritize with Security Analyst, plan remediation across systems.
• Deliver remediation within severity-based SLAs aligned to regulatory expectations.
• Monitor vendor advisories and translate into scoped remediation work.
• Package, test and deploy patches/firmware across endpoints, servers, network devices.
• Develop automation to close recurring vulnerabilities at scale.
• Submit change requests and coordinate maintenance windows.
• Coordinate with IT teams and vendors to remediate third-party vulnerabilities.
• Maintain remediation backlog and provide regular status updates to leadership.
• Stay current on vulnerability landscape including AI-assisted methods.

Skills

Vulnerability scanning

Risk analysis

Patch management

Scripting

Change management

Documentation

Education

Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or related field

Tools

Microsoft Defender

Configuration Manager

Intune

Job description

Executes vulnerability remediation across servers, endpoints, network and security devices, applications, and vendor-supplied systems within the infrastructure team. Converts findings and service level agreement (SLA) tracking into scheduled, tested, change-controlled remediation work. Coordinates closely with key internal business partners, and vendors to keep fixes moving within SLA and regulatory timelines. Administers vulnerability scanning and patch management tooling and maintains the documentation, metrics, and audit evidence supporting the credit union's vulnerability management program. Beyond working the backlog, proactively looks for ways to reduce risk exposure and automate patching and remediation processes, including through AI and other automation.

Primary Duties & Responsibilities

• Execute the vulnerability remediation lifecycle triage findings, partner with the Security Analyst on prioritization (CVSS, EPSS/exploitability, and business/asset risk), plan remediation, and verify closure — across servers, endpoints, network devices, and applications.


• Deliver remediation within severity-based SLAs (critical, high, medium, low) aligned to regulatory expectations and industry practice.


• Monitor vendor security advisories and vulnerabilities across the credit union's technology stack and translate them into scoped, prioritized remediation work.


• Package, test, and deploy software patches and firmware updates across endpoints, servers, and network/security devices, in partnership with Systems and Network Engineering.


• Develop and maintain detection and remediation scripts and automation to close recurring classes of vulnerabilities at scale, reducing manual, device-by-device remediation effort.


• Prepare and submit change requests through the formal change management process for patch, firmware, and configuration changes tied to vulnerability remediation, and coordinate maintenance windows with branch and business stakeholders.


• Coordinate with key internal IT teams and vendor support teams to remediate vulnerabilities in third-party software, middleware, and vendor-hosted platforms.


• Maintain a vulnerability remediation backlog and reporting; elevate aging or at-risk items and provide regular status updates to Infrastructure leadership.


• Prepare and file exceptions/risk acceptances according to established exception guidelines.


• Support decommissioning and lifecycle replacement of vulnerable, unsupported, or end-of-life hardware and software in coordination with Technology teams.


• Evaluate and recommend improvements to vulnerability scanning coverage, tooling, and remediation process to reduce time-to-remediate and ad hoc effort.


• Maintain detailed documentation of vulnerabilities, remediation actions, exceptions/risk acceptances, and configuration changes.


• Stay current on the evolving vulnerability and exploit landscape, including AI-accelerated vulnerability discovery and exploitation techniques, and adjust prioritization and tooling accordingly.


• Complete vendor and platform-specific training to maintain proficiency in deployed security and systems tooling.

Education

Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field. An equivalent combination of education and experience will be considered in lieu of a degree.

Experience

Minimum of three to five years of progressive experience in vulnerability management, systems/network engineering, or cybersecurity operations, with hands‑on responsibility for patch, firmware, or configuration remediation. Experience in financial services or a regulated industry is preferred. CompTIA Security+ required; CompTIA CySA+, GIAC GSEC, or equivalent vulnerability management/security operations certification preferred.

Skills, Job Knowledge & Abilities

• Strong hands-on experience with vulnerability scanning tools (e.g., Microsoft Defender


• CVE/CVSS/EPSS analysis; ability to translate findings into actionable, risk-prioritized remediation plans.


• Proficiency with endpoint and patch management tooling (e.g., Microsoft Configuration Manager, Intune) and scripting for detection and remediation at scale.


• Working knowledge of network and security device administration (firewalls, switches) and firmware lifecycle management.


• Familiarity with server administration (Windows/Linux), virtualization, and application/middleware patching.


• Understanding of change management (CAB) processes and ability to plan remediation around maintenance windows and business impact.


• Familiarity with compliance and regulatory frameworks relevant to financial services, including the GLBA Safeguards Rule, NCUA's Guidelines for Safeguarding Member Information (12 CFR Part 748, Appendix A), FFIEC IT Examination Handbook expectations, and PCI‑DSS.


• Excellent analytical, prioritization, and cross-team coordination skills; ability to manage a large, concurrent remediation backlog.


• Strong documentation skills for vulnerabilities, remediation actions, and audit evidence.