Security Engineer - Vulnerability Management

Meta; Washington (District of Columbia); On-site; USD 184,000 - 257,000; Full time

Job summary

Meta is seeking a Security Engineer on the Scaling – Vulnerability Management team to design AI-driven remediation pipelines and autonomous triage across Meta's codebase. You will build ML-based systems to identify, triage, and patch vulnerabilities at scale, enabling proactive defenses and safer automated upgrades.

You will collaborate with security, infrastructure, and product engineering teams to define scalable processes, apply responsible AI practices, and drive measurable risk reduction

Qualifications

• Design AI-powered autonomous remediation pipelines to patch third-party vulnerabilities.
• Develop ML-driven triage and contextualization agents for risk prioritization.
• Architect supply-chain defense systems and metadata enrichment for safe upgrades.
• Drive strategy with security, infrastructure, and product teams at scale.
• Identify and solve complex open-ended security problems with leadership.

Responsibilities

• Design and build AI-powered autonomous remediation pipelines that patch vulnerabilities across Meta's codebase.
• Develop ML-driven triage agents to assess and prioritize remediation tasks.
• Architect supply-chain defense systems, time-locked mirrors, and metadata enrichment services.
• Collaborate across security, infrastructure, and product engineering to scale automation.
• Own technically complex workstreams and guide others through ambiguity.

Skills

AI-powered remediation

ML-driven triage

Cross-functional collaboration

Python

Security engineering

Education

Bachelor's degree in Computer Science or Information Security

Job description

Summary:

Meta protects billions of people, and at our scale, vulnerabilities can't be managed by hand. As a Security Engineer on the Scaling – Vulnerability Management team, you'll build ML-based systems that automate how vulnerabilities are identified, triaged, and remediated across Meta's codebase. You'll design autonomous remediation pipelines and AI agents (like Viper and FixieAI) that cut through noise, surface real risk, and patch issues at a scale manual review can't reach — while building the supply‑chain defenses (package mirrors, metadata services, and orchestration via VMMC) that keep automated upgrades safe. It's a chance to turn vulnerability management from a reactive queue into a proactive, automated defense.

Required Skills:

Security Engineer - Vulnerability Management Responsibilities:

1. Design and build AI-powered autonomous remediation pipelines that detect and patch third‑party library vulnerabilities across Meta's codebase, scaling from thousands to hundreds of thousands of packages.
2. Develop ML‑driven triage and contextualization agents (e.g., Viper Assist, FixieAI) that autonomously assess, prioritize, and suppress vulnerability tasks with high precision — compressing remediation queues down to real, actionable risk.
3. Architect supply‑chain defense systems, including time‑locked package mirrors, quarantine mechanisms, and package decoration services that enrich dependency metadata for safer automated upgrades.
4. Drive cross‑functional strategy across security, infrastructure, and product engineering teams, defining processes that enable multiple teams to operate at scale with automation.
5. Identify and solve ambiguous, open‑ended problems where the solution is not initially known — owning technically complex workstreams while enabling others to execute.

Minimum Qualifications:

Minimum Qualifications:

1. Bachelor's degree in Computer Science, Information Security, or relevant field (or equivalent experience)
2. 5+ years work experience securing enterprise‑scale infrastructure software and services
3. 3-5+ years programming experience with at least one of the following languages: Python, PHP, Ruby, or similar scripting languages
4. Experience remediating infrastructure security gaps across broad corporate boundaries using influence and relationships
5. Experience with security control automation/monitoring or “compliance as code” implementations
6. Experience thinking critically and defending solutions with communication skills in a cross‑functional setting to influence decision makers across all levels of technical background
7. Experience identifying, triaging, and remediating software security vulnerabilities - including third‑party/open‑source dependency vulnerabilities across a large‑scale codebase

Preferred Qualifications:

Preferred Qualifications:

1. Demonstrated ability to integrate AI tools to optimize/redesign workflows and drive measurable impact (e.g., efficiency gains, quality improvements)
2. Experience adhering to and implementing responsible, ethical AI practices (e.g., risk assessment, bias mitigation, quality and accuracy reviews)
3. Demonstrated ongoing AI skill development (e.g., prompt/context engineering, agent orchestration) and staying current with emerging AI technologies

Public Compensation:

$184,000/year to $257,000/year + bonus + equity + benefits

Industry:

Internet

Equal Opportunity:

Meta is proud to be an Equal Employment Opportunity and Affitiative Action employer. We do not discriminate based upon race, religion, color, national origin, sex (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender, gender identity, gender expression, transgender status, sexual stereotypes, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics. We also consider qualified applicants with criminal histories, consistent with applicable federal, state and local law. Meta participates in the E-Verify program in certain locations, as required by law. Please note that Meta may leverage artificial intelligence and machine learning technologies in connection with applications for employment.

Meta is committed to providing reasonable accommodations for candidates with disabilities in our recruiting process. If you need any assistance or accommodations due to a disability, please let us know at [e-mail].