Senior Security Research Engineer

sonyinteractiveentertainmentglobal; United States; Remote; USD 176,000 - 263,000; Full time

Job summary

Sony Interactive Entertainment Global seeks a senior vulnerability management leader to drive threat exposure management, blending hands-on security research with program leadership across discovery, prioritization, remediation, and reporting.

Responsibilities include leading cross-team workstreams, translating goals into concrete plans, and maturing AI-enabled workflows to improve risk coverage and decision speed. Strong emphasis on MITRE ATT&CK and automation.

Qualifications

• 8+ years in information security, vulnerability management, or exposure management.
• Bachelor's degree in computer science, information security, or related field.
• Proven success leading complex technical workstreams across teams with measurable outcomes.
• Hands-on vulnerability research, technical analysis, and remediation guidance.
• Experience assessing vulnerabilities across OS, networks, cloud, apps, endpoints, containers, databases, or hybrid infra.
• Familiarity with vulnerability discovery, assessment, validation, or exposure-management platforms and integrations.
• Knowledge of adversarial tactics, exploitation, threat intelligence, and MITRE ATT&CK.
• Experience using scripting, programming, APIs, or automation to improve security workflows.

Responsibilities

• Lead vulnerability management workstreams across discovery, prioritization, validation, and mobilization.
• Translate program goals into delivery plans, milestones, success measures, and dependencies.
• Conduct hands-on vulnerability research to confirm conditions and reduce false positives.
• Characterize exploitability and provide actionable remediation guidance.
• Develop risk-based prioritization using threat intel, assets, and control effectiveness.
• Lead security validation activities and develop proofs of concept for controls.
• Partner with security and engineering to clarify ownership and remove barriers to closure.
• Advance platforms, data, analytics, and AI-enabled workflows to improve coverage and speed.
• Communicate trends and program outcomes to technical and leadership audiences.

Skills

Vulnerability management

Security research

Automation scripting

APIs & tooling

Threat intelligence

Education

Bachelor's degree in CS or Information Security

Tools

Snowflake

Domo

Job description

Role overview

A senior engineering role leading vulnerability management capabilities while transitioning the program toward a continuous threat exposure management operating model. The position blends hands-on security research and validation with technical program leadership across discovery, prioritization, remediation, and reporting.

Responsibilities

• Lead complex vulnerability management workstreams spanning discovery, prioritization, validation, and mobilization across diverse technology environments.
• Translate annual program goals into delivery plans, milestones, success measures, dependencies, and repeatable operating practices.
• Conduct hands-on vulnerability research and technical analysis to confirm conditions, eliminate false positives, characterize exploitability, and provide actionable remediation guidance.
• Develop risk-based prioritization using threat intelligence, exploitation evidence, asset and business context, and control effectiveness.
• Lead security validation activities and develop proofs of concept to evaluate defensive controls and distinguish material risk.
• Partner with security and engineering teams to clarify ownership, mobilize remediation, and resolve barriers to closure.
• Evolve underlying platforms, integrations, data, analytics, automation, and AI-enabled workflows to improve coverage and decision speed.
• Communicate trends, risks, and program outcomes to technical, operational, and leadership audiences.
• Mentor engineers and contribute to technical standards and procedures.

Requirements

• 8+ years of experience in information security, information technology, systems engineering, or a related field, with substantial experience in vulnerability management, security research, or exposure management.
• Bachelor's degree or equivalent in computer science, information security, or a related discipline.
• Demonstrated success leading complex technical workstreams across multiple teams and translating objectives into measurable outcomes.
• Hands-on experience with vulnerability research, technical analysis, security validation, risk-based prioritization, and remediation guidance.
• Experience assessing vulnerabilities across operating systems, networks, cloud services, applications, endpoints, containers, databases, or hybrid infrastructure.
• Familiarity with vulnerability discovery, assessment, validation, or exposure-management platforms and their integrations.
• Knowledge of adversarial tactics, exploitation techniques, threat intelligence, and frameworks such as MITRE ATT&CK.
• Experience using scripting, programming, APIs, or automation to improve security analysis and operational workflows.

Nice to have

• Experience with continuous security validation, adversarial exposure validation, exploit research, or proof-of-concept development.
• Background securing cloud, container, application, or build-pipeline environments and embedding security into engineering workflows.
• Experience with security-data and analytics platforms such as Snowflake, Domo, or comparable tools.
• Experience applying automation, advanced analytics, or AI-enabled capabilities to vulnerability analysis, prioritization, validation, or remediation.

Benefits and work setup

• Flexible role that can be performed remotely, with pay ranges varying by geographic location; an estimated base pay range of $175,500–$263,300 USD is listed for candidates based in Seattle.
• Comprehensive benefits package typically including medical, dental, vision, retirement plan matching, paid time off, a wellness program, and employee product discounts.
• Bonus package eligibility for the role.
• Some travel may be required.