Senior Exposure Management Engineer

KeyBank; Brooklyn (OH); On-site; USD 96,000 - 181,000; Full time

Job summary

KeyBank is seeking a Senior Exposure Management Engineer in Brooklyn, OH to govern security baselines across on‑prem and cloud environments. You will drive compliance, monitor configuration drift, and support audits to reduce residual risk.

The role partners with Security Architecture, Infrastructure, and Cloud teams to operationalize standards and automate validation for continuous improvement.

Qualifications

• 8+ years of experience in security engineering, configuration management, or related roles.

Responsibilities

• Govern enterprise security baseline standards across OS, cloud, apps, databases, and network infrastructure.

Skills

8+ years security engineering

Vulnerability scanning

Tenable/Qualys/Rapid7

Cloud platforms (AWS/Azure/GCP)

Security frameworks (NIST CSF, CIS, SC

ServiceNow security modules

Documentation & reporting

Travel willingness

Education

Bachelor's degree in CS/Cybersecurity or related field

Tools

Vulnerability scanners

ServiceNow Vulnerability Response

Cloud platforms (AWS/Azure/GCP)

Job description

## Senior Exposure Management EngineerApply: Brooklyn, OH: Full time: Posted Today: End Date: October 30, 2026 (30+ days left to apply): R-42178**Location:**4910 Tiedeman Road, Brooklyn Ohio**Position Summary**As a member of the Cyber Defense team within Corporate Information Security, the Senior Exposure Management Engineer is responsible for governing, assessing, and maintaining enterprise security baseline standards across on-premises, cloud, and hybrid environments. This role ensures technology assets remain aligned with approved security configuration standards, industry frameworks, and regulatory requirements through continuous assessment, compliance monitoring, and risk-based remediation activities.The Senior Exposure Management Engineer leverages automated assessment and compliance validation tools to identify configuration weaknesses, measure adherence to enterprise security baselines, and monitor configuration drift across the environment. The role partners closely with Security Architecture, Infrastructure, Engineering, Cloud, and Application teams to drive remediation, manage exceptions, support audit and regulatory examinations, and enhance the organization's overall security posture through consistent application of standards-based controls.This position also leads the evolution of the enterprise baseline program by evaluating changes to industry guidance, improving compliance measurement capabilities, expanding automation, and providing actionable reporting that enables informed risk-based decisions and continuous exposure reduction**Key Responsibilities*** **Security Baseline Governance** + Maintain and govern enterprise-approved security baseline standards across operating systems, cloud platforms, applications, databases, and network infrastructure. + Support the review and adoption of updates to CIS Benchmarks and other industry-recognized security standards through established governance processes. + Partner with Security Architecture and technology teams to ensure baseline requirements are appropriately documented, communicated, and operationalized.* **Configuration Compliance Assessment** + Conduct ongoing configuration compliance assessments utilizing automated scanning and validation tools to measure adherence to approved baseline standards. + Validate remediation activities through continuous monitoring and reassessment. + Identify, analyze, and report configuration weaknesses that increase organizational risk.* **Configuration Drift Monitoring** + Monitor configuration drift across enterprise assets and provide reporting on deviations from approved security baselines. + Partner with technology owners to investigate non-compliant configurations and drive timely remediation.* **Exception and Risk Management** + Manage baseline exceptions, compensating controls, and risk acceptance documentation. + Ensure approved deviations from security standards are appropriately documented, reviewed, and tracked through remediation or renewal cycles.* **Compliance Reporting & Metrics** + Develop and maintain configuration compliance metrics, dashboards, and executive reporting. + Provide visibility into compliance trends, remediation progress, assessment coverage, and risk reduction activities. + Support reporting through ServiceNow and other enterprise governance platforms.* **Audit & Regulatory Support** + Maintain documentation, evidence, and reporting required to support internal audits, external examinations, and regulatory assessments. + Demonstrate compliance with enterprise security requirements, industry standards, and applicable regulatory obligations.* **Cross-Functional Collaboration** + Partner with Infrastructure, Cloud, Application, Engineering, and Security teams to support implementation and maintenance of approved security baselines. + Provide guidance regarding baseline compliance requirements and remediation priorities.* **Continuous Improvement & Automation** + Identify opportunities to improve assessment coverage, compliance measurement, reporting, and operational efficiencies through automation. + Support implementation of automated compliance validation and reporting capabilities.* **Threat-Informed Exposure Reduction** + Collaborate with Vulnerability Management, Threat Intelligence, Red Team, and Exposure Management teams to prioritize remediation of configuration weaknesses that contribute to exploitable attack paths and elevated risk. + Utilize risk-based methodologies to focus remediation efforts on the highest-impact configuration deficiencies.* **Knowledge Sharing** + Share security baseline best practices, emerging standards, and compliance requirements through documentation, training, and stakeholder engagement.**Required Qualifications*** Bachelor’s degree in computer science, Cybersecurity, or related field—or equivalent experience.* 8+ years of experience in security engineering, configuration management, or related roles.* Experience with Vulnerability Management platforms (Tenable, Qualys, Rapid7 etc) running vulnerability scans, monitoring agent health, and maintaining scanner operability.* Comprehensive expertise in Tenable or comparable vendor solutions for compliance scanning.* Broad understanding of enterprise computing platforms and their configuration management, compliance, and security considerations.* Hands-on experience with cloud platforms (Google Cloud, Microsoft Azure, AWS).* Familiarity with security frameworks and standards (e.g., CIS Benchmarks, SCAP, NIST CSF, MITRE ATT\\&CK).* Experience with ServiceNow security related modules such as Vulnerability Response & Configuration Compliance* Effective research, documentation, and reporting skills.* Willingness to travel.**Preferred Certifications*** Certified Information Systems Security Professional (CISSP)* GIAC Security Essentials (GSEC)* GIAC Certified Vulnerability Assessor (GCVA)* Microsoft Certified: Azure Security Engineer Associate* AWS Certified Security – Specialty* Google Cloud Security EngineerCOMPENSATION AND BENEFITSThis position is eligible to earn a base salary in the range of $96,000.00 - $181,000.00 annually. Placement within the pay range may differ based upon various factors, including but not limited to skills, experience and geographic location. Compensation for this role also includes eligibility for incentive compensation which may include production, commission, and/or discretionary incentives.Please click here for a list of benefits for which this position is eligible.Key has implemented an approach to employee workspaces which prioritizes in-office presence, while providing flexible options in circumstances where roles can be performed effectively in a mobile environment.Job Posting Expiration Date: 10/30/2026