Senior Vulnerability Management Engineer — Scale & Automation

SoFi; Seattle (WA); On-site; USD 180,000 - 280,000; Full time

Job summary

SoFi is hiring a Staff Vulnerability Management Engineer to lead complex security initiatives across applications, cloud, containers, and hardware surfaces. You will design scalable triage pipelines, implement risk‑based prioritization, and partner with Engineering, SRE, Compliance, and Legal to balance remediation with velocity.

You’ll mentor engineers, charter secure changes in code, and shape end‑to‑end vulnerability workflows, including SBOM and supply‑chain security, for durable risk

Qualifications

• Bachelor’s degree in CS, Cybersecurity, Engineering, or related field, or equivalent practical experience.
• Deep expertise in vulnerability management, security engineering, and modern infrastructure including cloud and containers.
• Strong programming/scripting skills (Python, Go, JavaScript/TypeScript) for automation at scale.

Responsibilities

• Lead high‑complexity vulnerability management initiatives across multiple program areas.
• Design, build, and productionize scalable triage and prioritization automation with integrations and observability.
• Develop risk‑based prioritization models using CVSS, EPSS, KEV, threat intel, and asset context.
• Engineer vulnerability workflows across cloud, Kubernetes, software supply chain, and hardware surfaces.
• Own SBOM inventory, SLSA controls, and CI/CD integration of SAST/SCA/secret scanning.

Skills

Vulnerability management

Security engineering

Programming/scripting

Cloud & Kubernetes

Communication

Education

Bachelor's degree in CS/Engineering or related field

Tools

Wiz

Semgrep

Snyk

Socket

Rapid7

Tenable

Checkmarx

Job description

SoFi is hiring a Staff Vulnerability Management Engineer to lead complex security initiatives across applications, cloud, containers, and hardware surfaces. You will design scalable triage pipelines, implement risk‑based prioritization, and partner with Engineering, SRE, Compliance, and Legal to balance remediation with velocity.

You’ll mentor engineers, charter secure changes in code, and shape end‑to‑end vulnerability workflows, including SBOM and supply‑chain security, for durable risk