Senior Vulnerability Engineer

King-County,-W; Seattle (WA); Hybrid; USD 140,000 - 180,000; Full time

Job summary

King County's KCIT is seeking a Senior Vulnerability Engineer to lead enterprise vulnerability management across networks, cloud, and applications. You will identify, validate, prioritize, and remediate vulnerabilities, setting risk-informed remediation SLAs.

You will collaborate with infrastructure, security operations, DevOps, and governance teams, drive automation, and advance the program maturity through threat-informed decisions.

Qualifications

• Four or more years of experience in information security, vulnerability management, application security, security engineering, or related discipline.
• Strong understanding of modern security vulnerabilities, exploit techniques, and common attack vectors.
• Deep knowledge of vulnerability scanning tools (e.g., Rapid7, Qualys, Tenable), asset inventory systems, and security orchestration platforms.
• Familiarity with cloud security (AWS, Azure, GCP), container security, and modern DevOps workflows.
• Strong understanding of operating systems, networking fundamentals, and secure development practices.
• Awareness of regulatory, compliance, and industry security standards.
• Ability to translate technical findings into clear business risk for diverse stakeholders.
• Strong analytical skills for evaluating vulnerability risk, prioritization, and remediation strategies.
• Excellent communication and relationship-building skills across technical and non-technical teams.
• Skill in automating repetitive tasks and improving workflows.
• Ability to lead cross-team efforts, manage escalations, and drive timely decision-making.

Responsibilities

• Lead vulnerability operations: manage enterprise vulnerability scanning, validate accuracy, tune templates, and monitor health.
• Engage in risk-based prioritization: evaluate impacts, review patch releases, assess advisories, monitor feeds.
• Drive engineering & automation: integrate platforms, automate remediation, develop scripts, create APIs, automate reporting.
• Engage stakeholders: communicate findings in business terms and coordinate remediation timelines.
• Support threat and incident response: evaluate emergencies, identify affected assets, and coordinate patching.
• Guide program improvement: refine processes, tools, KPIs, and maturity roadmap; mentor team.

Skills

Vulnerability management

Information security

Security engineering

Cloud security

Networking fundamentals

Automation

Cross-team collaboration

Education

Bachelor’s degree in Computer Science, Information Security, or related field

Tools

Rapid7

Qualys

Tenable

Security orchestration platforms

Job description

Senior Vulnerability Engineer

King County Information Technology (KCIT) is seeking a Senior Vulnerability Engineer to join the Information Security, Risk & Compliance team and lead the technical execution of its enterprise vulnerability management program. The role is responsible for identifying, assessing, validating, and prioritizing vulnerabilities across infrastructure, cloud environments, applications, and network devices. It serves as the technical authority ensuring vulnerabilities are accurately identified, risk-prioritized, and remediated according to policies and SLAs. The position collaborates closely with infrastructure, application, cloud, networking, security operations, and governance teams to reduce cyber risk through continuous monitoring, threat-informed prioritization, automation, and process improvement. Additionally, the engineer provides technical leadership in evaluating emerging threats, implementing vulnerability technologies, developing remediation strategies, and advancing program maturity.

About King County Department of Information Technology (KCIT)

King County is committed to being the best-run government in the nation, and King County Information Technology (KCIT) is helping lead that transformation. KCIT harnesses the power of technology to modernize operations, advance digital equity and social justice, and deliver innovative solutions that engage, empower, and serve our residents, businesses, and community partners.

Recognized by the National Association of Counties (NACo) for excellence in vision, strategy, innovation, and collaboration, KCIT is focused on delivering smart, secure, and customer-centered technology services that strengthen county operations and support thriving, resilient communities. As the technology business partner to all 18 County departments, KCIT provides the foundational systems and services that power many of the region’s most essential functions. We work side-by-side with our partners to design and deliver technology solutions that enhance customer experience and advance King County’s mission. Learn more about KCIT at: http://kingcounty.gov/depts/it.aspx.

Vulnerability Operations

• Manage enterprise vulnerability scanning
• Validate scanner accuracy and investigate false positives
• Tune scan templates and credentials
• Maintain asset inventory coverage
• Monitor scan health and failures
• Validate remediation effectiveness
• Maintain vulnerability exceptions
• Track remediation SLAs
• Support external penetration testing

Risk-Based Prioritization

• Evaluate potential impacts of vulnerabilities
• Reviewing Microsoft’s Patch Tuesday releases
• Assess vendor advisories
• Monitor threat intelligence feeds
• Determine emergency patch requirements
• Develop remediation recommendations

Engineering & Automation

• Integrate vulnerability platforms with ticketing systems
• Automate remediation workflows
• Develop PowerShell/Python scripts
• Create APIs between scanning platforms and CMDBs
• Automate executive reporting
• Reduce manual effort

Stakeholder Engagement

• Communicate vulnerability findings to stakeholders in clear, business focused language
• Provide guidance on remediation strategies, expected timelines, and resource needs
• Coordinate with engineering, product, infrastructure, and operations teams to ensure timely vulnerability resolution
• Set and manage expectations around remediation windows, technical constraints, and risk acceptance considerations
• Build and maintain strong cross-functional relationships with technical teams, leadership, and compliance groups
• Recommend secure development practices and process improvements based on recurring vulnerability patterns
• Act as the escalation point for high-risk or complex vulnerabilities requiring urgent cross-team coordination

Threat & Incident Response Support

• Evaluate emergency vulnerabilities
• Determine exposure within the environment
• Identify affected assets
• Recommend mitigations
• Coordinate emergency patching
• Produce executive impact assessments
• Support incident response teams

Program Improvement

• Identify systemic issues and streamline vulnerability management processes
• Enhance scanning tools, asset coverage, reporting, and remediation workflows
• Maintain and refine policies and procedures to improve program maturity
• Strengthen prioritization models to align remediation with business risk
• Integrate security practices earlier in the SDLC through cross-team collaboration
• Define and track KPIs to measure program effectiveness and guide strategy
• Lead automation initiatives to reduce manual work and speed remediation
• Support capability growth through maturity roadmaps and team mentorship

• Four (4) or more years of experience in information security, vulnerability management, application security, security engineering, or related discipline.
• Strong understanding of modern security vulnerabilities, exploit techniques, and common attack vectors.
• Deep knowledge of vulnerability scanning tools (e.g., Rapid7, Qualys, Tenable), asset inventory systems, and security orchestration platforms.
• Familiarity with cloud security (AWS, Azure, GCP), container security, and modern DevOps workflows.
• Strong understanding of operating systems, networking fundamentals, and secure development practices.
• Awareness of regulatory, compliance, and industry security standards.
• Ability to translate technical findings into clear business risk for diverse stakeholders.
• Strong analytical skills for evaluating vulnerability risk, prioritization, and remediation strategies.
• Excellent communication and relationship-building skills across technical and non-technical teams.
• Skill in automating repetitive tasks and improving workflows.
• Ability to lead cross-team efforts, manage escalations, and drive timely decision-making.

Desirable Qualifications

• Bachelor’s degree in Computer Science, Information Security, or related field (or equivalent practical experience)
• Relevant security certifications such as OSCP, OSWE, CISSP, GIAC (GSEC, GCIH, GPEN), Security+ or similar are preferred

Hybrid Work

KCIT works in a hybrid model, with days in the office as well as telecommuting. The ratio of remote to onsite work will be dependent on business needs and is subject to change. The primary onsite location is the Chinook Building, 401 5th Ave, Seattle, WA 98104.

Employees must reside in Washington state and within a reasonable distance to their King County worksite to respond to workplace reporting requirements.

King County has a robust collection of tools and resources to support working remotely. The individual selected for this opportunity will join an innovative and progressive team that is redefining how we work as we transition to the department's hybrid environment. Employees will be provided with a County-issued laptop and must maintain a home workspace with an internet connection where they can reliably perform work and remain available and responsive during scheduled work hours.

Work Schedule

The normal workweek for this position is Monday through Friday, 8:00 a.m. to 5:00 p.m. Alternative schedules may be considered by your manager. This position will participate on the After-Hours Support (AHS) team rotating across a pool of 12 to 15 staff (24x7, 7-day rotation Monday-Sunday).

FLSA Status

This position is FLSA Exempt and is not eligible for overtime pay.

Classification

IT Production Engineer-Senior (Job code: 741601)

Union

This position is represented by Protec17: Information Technology.

Who May Apply

This recruitment is open to all qualified candidates. We value diversity, diverse perspectives and life experience and encourage people of all backgrounds to apply.

King County's Vision, Mission, and ACTIVATE Values unite us

King County serves residents with a relentless sense of urgency, delivering on commitments with transparency and accountability. We are action-oriented, creative problem solvers who collaborate across roles, engage directly with communities, and challenge the status quo to achieve meaningful impact. As a unified team, we uphold high ethical and stewardship standards, embrace change, stay curious, and continuously improve. Across all interactions, we listen first, act quickly, and stay aligned as a team to earn and sustain public trust. Learn more about our Vision, Mission, and ACTIVATE Values here and visit our Why work at King County page here.

King County is an Equal Employment Opportunity (EEO) Employer

No person is unlawfully excluded from employment opportunities based on sex, race, color, national origin, ethnicity, religious affiliation, disability, sexual orientation, gender identity or expression, age except by minimum age and retirement provisions, pregnancy, status as a family caregiver, parental status, marital status, military status or status as a veteran who was honorably discharged or who was discharged solely as a result of the person's sexual orientation or gender identity or expression, citizenship or immigration status, genetic information, or other protected class. However, to the extent that distinction or differential treatment on the basis of citizenship or immigration status is authorized by either federal or state law, regulation, or government contract, it is not an unfair practice.

Our EEO policy applies to all employment actions, including but not limited to recruitment, hiring, selection for training, promotion, transfer, demotion, layoff, termination, rates of pay or other forms of compensation.