Senior Security Baseline & Exposure Engineer

KeyBank; Brooklyn (OH); Hybrid; USD 96,000 - 181,000; Full time

Job summary

KeyBank is seeking a Senior Exposure Management Engineer to govern enterprise security baselines across on-prem, cloud, and hybrid environments. You will lead assessments, monitor drift, and drive remediation with cross-functional teams, supporting audits and regulatory exams.

You will evolve the baseline program by adopting industry guidance, expanding automation, and delivering actionable reporting to enable risk-based decisions and continuous exposure reduction.

Qualifications

• Bachelor’s degree in computer science, Cybersecurity, or related field—or equivalent experience.
• 8+ years of experience in security engineering, configuration management, or related roles.
• Experience with Vulnerability Management platforms (Tenable, Qualys, Rapid7 etc) running vulnerability scans, monitoring agent health, and maintaining scanner operability.
• Comprehensive expertise in Tenable or comparable vendor solutions for compliance scanning.
• Broad understanding of enterprise computing platforms and their configuration management, compliance, and security considerations.
• Hands-on experience with cloud platforms (Google Cloud, Microsoft Azure, AWS).
• Familiarity with security frameworks and standards (e.g., CIS Benchmarks, SCAP, NIST CSF, MITRE ATT&CK).
• Experience with ServiceNow security related modules such as Vulnerability Response & Configuration Compliance
• Effective research, documentation, and reporting skills.
• Willingness to travel.

Responsibilities

• Maintain and govern enterprise-approved security baseline standards across operating systems, cloud platforms, applications, databases, and network infrastructure.
• Review and adopt updates to CIS Benchmarks and other industry-recognized security standards through governance processes.
• Partner with Security Architecture and technology teams to ensure baseline requirements are documented, communicated, and operationalized.
• Conduct ongoing configuration compliance assessments using automated scanning and validation tools.
• Validate remediation activities through continuous monitoring and reassessment.
• Identify, analyze, and report configuration weaknesses that increase organizational risk.
• Monitor configuration drift across enterprise assets and provide reporting on deviations.
• Collaborate with technology owners to investigate non-compliant configurations and drive remediation.
• Manage baseline exceptions, compensating controls, and risk acceptance documentation.
• Ensure approved deviations are documented and tracked through remediation or renewal cycles.
• Develop and maintain configuration compliance metrics, dashboards, and executive reporting.
• Support reporting through ServiceNow and other governance platforms.
• Maintain documentation and evidence to support audits and regulatory assessments.
• Demonstrate compliance with enterprise security requirements and applicable regulations.
• Partner with Infrastructure, Cloud, Application, Engineering, and Security teams to support baseline implementation and maintenance.
• Identify opportunities to improve assessment coverage, reporting, and automation.
• Prioritize remediation of weaknesses that contribute to exploitable attack paths.

Skills

Security engineering

Configuration management

Documentation & reporting

Willingness to travel

Education

Bachelor’s degree in computer science or cybersecurity

Equivalent experience

Tools

Tenable

Qualys

Rapid7

ServiceNow security modules

Job description

KeyBank is seeking a Senior Exposure Management Engineer to govern enterprise security baselines across on-prem, cloud, and hybrid environments. You will lead assessments, monitor drift, and drive remediation with cross-functional teams, supporting audits and regulatory exams.

You will evolve the baseline program by adopting industry guidance, expanding automation, and delivering actionable reporting to enable risk-based decisions and continuous exposure reduction.