Senior Vulnerability Engineer
King County, WA
Get a reply from this employer
Your resume and cover letter, tailored to exactly what they’re hiring for.
Benefits offered by this job
Job summary
King County Information Technology (KCIT) seeks a Senior Vulnerability Engineer to lead the enterprise vulnerability management program across infrastructure, cloud, applications, and network devices. You will prioritize vulnerabilities, validate scanner accuracy, and drive remediation strategies with cross-functional teams.
You will advance threat-informed prioritization, implement vulnerability technologies, and contribute to program maturity through automation and process improvements.
Qualifications
- Four (4) or more years of experience in information security, vulnerability management, application security, security engineering, or related discipline.
- Strong understanding of modern security vulnerabilities, exploit techniques, and common attack vectors.
Responsibilities
- Lead enterprise vulnerability scanning and validate scanner accuracy.
- Tune scan templates and credentials; maintain asset inventory coverage.
- Monitor scan health, remediation SLAs, and support external pen testing.
- Automate remediation workflows and develop security scripts.
- Communicate findings to stakeholders and guide remediation timelines.
Skills
Education
Tools
Job description
King County Information Technology (KCIT) is seeking a Senior Vulnerability Engineer to join the Information Security, Risk & Compliance team and lead the technical execution of its enterprise vulnerability management program. The role is responsible for identifying, assessing, validating, and prioritizing vulnerabilities across infrastructure, cloud environments, applications, and network devices. It serves as the technical authority ensuring vulnerabilities are accurately identified, risk-prioritized, and remediated according to policies and SLAs. The position collaborates closely with infrastructure, application, cloud, networking, security operations, and governance teams to reduce cyber risk through continuous monitoring, threat-informed prioritization, automation, and process improvement. Additionally, the engineer provides technical leadership in evaluating emerging threats, implementing vulnerability technologies, developing remediation strategies, and advancing program maturity.
King County is committed to being the best-run government in the nation, and King County Information Technology (KCIT) is helping lead that transformation. KCIT harnesses the power of technology to modernize operations, advance digital equity and social justice, and deliver innovative solutions that engage, empower, and serve our residents, businesses, and community partners. Recognized by the National Association of Counties (NACo) for excellence in vision, strategy, innovation, and collaboration, KCIT is focused on delivering smart, secure, and customer-centered technology services that strengthen county operations and support thriving, resilient communities. As the technology business partner to all 18 County departments, KCIT provides the foundational systems and services that power many of the region’s most essential functions. We work side‑by‑side with our partners to design and deliver technology solutions that enhance customer experience and advance King County’s mission. Learn more about KCIT at: http://kingcounty.gov/depts/it.aspx.
This recruitment may be used to fill additional vacancies that may occur.
- Manage enterprise vulnerability scanning
- Validate scanner accuracy and investigate false positives
- Tune scan templates and credentials
- Maintain asset inventory coverage
- Monitor scan health and failures
- Validate remediation effectiveness
- Maintain vulnerability exceptions
- Track remediation SLAs
- Support external penetration testing
- Evaluate potential impacts of vulnerabilities
- Reviewing Microsoft's Patch Tuesday releases
- Assess vendor advisories
- Monitor threat intelligence feeds
- Determine emergency patch requirements
- Develop remediation recommendations
- Integrate vulnerability platforms with ticketing systems
- Automate remediation workflows
- Develop PowerShell/Python scripts
- Create APIs between scanning platforms and CMDBs
- Automate executive reporting
- Reduce manual effort
- Communicate vulnerability findings to stakeholders in clear, business focused language
- Provide guidance on remediation strategies, expected timelines, and resource needs
- Coordinate with engineering, product, infrastructure, and operations teams to ensure timely vulnerability resolution
- Set and manage expectations around remediation windows, technical constraints, and risk acceptance considerations
- Build and maintain strong cross-functional relationships with technical teams, leadership, and compliance groups
- Recommend secure development practices and process improvements based on recurring vulnerability patterns
- Act as the escalation point for high-risk or complex vulnerabilities requiring urgent cross-team coordination
- Evaluate emergency vulnerabilities
- Determine exposure within the environment
- Identify affected assets
- Recommend mitigations
- Coordinate emergency patching
- Produce executive impact assessments
- Support incident response teams
- Identify systemic issues and streamline vulnerability management processes
- Enhance scanning tools, asset coverage, reporting, and remediation workflows
- Maintain and refine policies and procedures to improve program maturity
- Strengthen prioritization models to align remediation with business risk
- Integrate security practices earlier in the SDLC through cross-team collaboration
- Define and track KPIs to measure program effectiveness and guide strategy
- Lead automation initiatives to reduce manual work and speed remediation
- Support capability growth through maturity roadmaps and team mentorship
- Four (4) or more years of experience in information security, vulnerability management, application security, security engineering, or related discipline.
- Strong understanding of modern security vulnerabilities, exploit techniques, and common attack vectors.
- Deep knowledge of vulnerability scanning tools (e.g., Rapid7, Qualys, Tenable), asset inventory systems, and security orchestration platforms.
- Familiarity with cloud security (AWS, Azure, GCP), container security, and modern DevOps workflows.
- Strong understanding of operating systems, networking fundamentals, and secure development practices.
- Awareness of regulatory, compliance, and industry security standards.
- Ability to translate technical findings into clear business risk for diverse stakeholders.
- Strong analytical skills for evaluating vulnerability risk, prioritization, and remediation strategies.
- Excellent communication and relationship-building skills across technical and non-technical teams.
- Skill in automating repetitive tasks and improving workflows.
- Ability to lead cross-team efforts, manage escalations, and drive timely decision-making.
- Bachelor’s degree in Computer Science, Information Security, or related field (or equivalent practical experience)
- Relevant security certifications such as OSCP, OSWE, CISSP, GIAC (GSEC, GCIH, GPEN), Security+ or similar are preferred
Hybrid Work: KCIT works in a hybrid model, with days in the office as well as telecommuting. The ratio of remote to onsite work will be dependent on business needs and is subject to change. The primary onsite location is the Chinook Building, 401 5th Ave, Seattle, WA 98104.
Employees must reside in Washington state and within a reasonable distance to their King County worksite to respond to workplace reporting requirements.
King County has a robust collection of tools and resources to support working remotely. The individual selected for this opportunity will join an innovative and progressive team that is redefining how we work as we transition to the department's hybrid environment. Employees will be provided with a County-issued laptop and must maintain a home workspace with an internet connection where they can reliably perform work and remain available and responsive during scheduled work hours.
Work Schedule: The normal workweek for this position is Monday through Friday, 8:00 a.m. to 5:00 p.m. Alternative schedules may be considered by your manager. This position will participate on the After-Hours Support (AHS) team rotating across a pool of 12 to 15 staff (24x7, 7-day rotation Monday-Sunday).
FLSA Status: This position is FLSA Exempt and is not eligible for overtime pay.
Classification: IT Production Engineer-Senior (Job code: 741601)
Union: This position is represented by Protec17: Information Technology.
Who May Apply: This recruitment is open to all qualified candidates. We value diversity, diverse perspectives and life experience and encourage people of all backgrounds to apply.
Are you ready to make a difference? Come join the team dedicated to serving one of the nation's best places to live, work and play.
King County serves residents with a relentless sense of urgency, delivering on commitments with transparency and accountability. We are action-oriented, creative problem solvers who collaborate across roles, engage directly with communities, and challenge the status quo to achieve meaningful impact. As a unified team, we uphold high ethical and stewardship standards, embrace change, stay curious, and continuously improve. Across all interactions, we listen first, act quickly, and stay aligned as a team to earn and sustain public trust. Learn more about our Vision, Mission, and ACTIVATE Values here and visit our Why work at King County page here.
No person is unlawfully excluded from employment opportunities based on sex, race, color, national origin, ethnicity, religious affiliation, disability, sexual orientation, gender identity or expression, age except by minimum age and retirement provisions, pregnancy, status as a family caregiver, parental status, marital status, military status or status as a veteran who was honorably discharged or who was discharged solely as a result of the person's sexual orientation or gender identity or expression, citizenship or immigration status, genetic information, or other protected class. However, to the extent that distinction or differential treatment on the basis of citizenship or immigration status is authorized by either federal or state law, regulation, or government contract, it is not an unfair practice.
Our EEO policy applies to all employment actions, including but not limited to recruitment, hiring, selection for training, promotion, transfer, demotion, layoff, termination, rates of pay or other forms of compensation.
- Excellent medical, dental, and vision coverage options: King County provides eligible employees with options, so they can decide what’s best for themselves and their eligible dependents
- Life and disability insurance: employees are provided basic coverage and given the opportunity to purchase additional insurance for both the employee and eligible dependents
- Retirement: eligible King County employees may participate in a pension plan through the Washington State Department of Retirement Systems and a 457(b) deferred-compensation plan
- Transportation program and ORCA transit pass
- 12 paid holidays each year plus two personal holidays
- Generous vacation and paid sick leave
- Paid parental, family and medical, and volunteer leaves
- Flexible Spending Account
- Wellness programs
- Onsite activity centers
- Employee Giving Program
- Employee assistance programs
- Flexible schedules and telecommuting options, depending on position
- Training and career development programs
For additional information about employee benefits, visit our Benefits, Payroll, and Retirement Page.
This is a general description of the benefits offered to eligible King County employees, and every effort has been made to ensure its accuracy. If any information on this document conflicts with the provisions of a collective bargaining agreement (CBA), the CBA prevails.
Benefits for Term Limited Temporary (TLT) or Short Term Temporary (STT) positions, including leave eligibility and/or participation in the pension plan through the Washington State Department of Retirement Systems, will vary based upon the terms and details of the position. Short Term Temporary positions are not eligible for an ORCA transit pass.
For inquiries about the specifics of this position, please contact the recruiter identified on this job posting.
'/%3e%3cpath%20d='M101.744%2012.4726L102.894%2016.1947L99.0021%2013.2201L101.744%2012.4726ZM105.3%208.40937H100.488L99.0026%203.59473L97.5116%208.41047L92.7%208.40385L96.5965%2011.3834L95.1055%2016.1942L99.0021%2013.2196L101.408%2011.3834L105.3%208.40992V8.40937Z'%20fill='white'/%3e%3cdefs%3e%3clinearGradient%20id='paint0_linear_5593_1381'%20x1='90'%20y1='9.44471'%20x2='99'%20y2='9.44471'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%2300AD70'/%3e%3cstop%20offset='0.998594'%20stop-color='%2300B67A'/%3e%3cstop%20offset='1'%20stop-color='%23DCDCE6'/%3e%3c/linearGradient%3e%3c/defs%3e%3c/svg%3e){kind=small}
