Senior Vulnerability Engineer — Cloud, Containers & Apps

SoFi; Seattle (WA); On-site; USD 140,000 - 200,000; Full time

Benefits offered by this job

Benefits program

Disability accommodations

Job summary

SoFi in Seattle is seeking a Senior Vulnerability Management Engineer to independently identify, assess, prioritize, and drive remediation across applications, infrastructure, containers, Kubernetes, and third-party dependencies.

You will own internal vulnerability-management tools, improve reporting, and collaborate with engineering to implement fixes while leveraging approved AI tools to accelerate security automation and documentation.

Qualifications

• Bachelor’s degree or equivalent practical experience in CS/IS/Cybersecurity.
• 4+ years in information security, vulnerability management, or related field.
• Familiarity with CVE, CVSS, CWE, OWASP, and risk-based prioritization.
• Experience with vulnerability-management platforms (e.g., Qualys) and SAST/DAST/SA tools.

Responsibilities

• Perform vulnerability assessments across applications, OS, containers, Kubernetes, and third-party dependencies.
• Identify origin of vulnerable dependencies and classify direct vs transitive.
• Recommend safe upgrades, patches, or compensating controls.
• Own and maintain internal vulnerability-management tools and dashboards.
• Integrate security tools with APIs and ticketing systems for reporting.

Skills

Vulnerability management

Security engineering

Programming/scripting

Risk-based prioritization

Independent initiative

Education

Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, or equivalent

Tools

Qualys

Docker/Kubernetes tooling

CI/CD tooling

Software composition analysis

Job description

SoFi in Seattle is seeking a Senior Vulnerability Management Engineer to independently identify, assess, prioritize, and drive remediation across applications, infrastructure, containers, Kubernetes, and third-party dependencies.

You will own internal vulnerability-management tools, improve reporting, and collaborate with engineering to implement fixes while leveraging approved AI tools to accelerate security automation and documentation.