Sr. Vulnerability Management & SOAR Engineer

New Balance Athletics, Inc.; Richardson (TX); Hybrid; USD 105,000 - 156,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401K

Tuition reimbursement

Lifestyle stipend

Parental leave

Vacation 4 weeks

Job summary

New Balance Athletics, Inc. is seeking a Senior Vulnerability Management & SOAR Engineer to lead the enterprise vulnerability program across on‑premises, cloud, and containers.

You will own discovery, validation, prioritization, remediation coordination, and security automation, partnering with Infrastructure, DevOps, and Security teams to reduce cyber risk. The role blends hands‑on vulnerability operations with strategic program ownership, including developing policies, dashboards, and

Qualifications

• Experience leading enterprise vulnerability management programs across hybrid environments.
• Familiarity with CVE, CVSS, CISA KEV, exploit intel.
• Experience integrating vulnerability workflows into CI/CD pipelines.

Responsibilities

• Own and mature the enterprise Vulnerability Management program across on-premises, cloud, containerized, endpoint, network, embedded, and application environments.
• Lead remediation efforts across technical teams to meet SLAs and risk targets.
• Design, develop, and maintain SOAR playbooks to automate vulnerability intake, triage, and reporting.
• Create executive metrics and reporting on risk reduction, remediation trends, and asset coverage.

Skills

Vulnerability Mgmt

SOAR automation

Python scripting

PowerShell

Bash scripting

REST APIs

CI/CD pipelines

Threat intel

Cloud security

Tools

Tenable

Qualys

Rapid7

Microsoft Defender Vulnerability Management

Azure

AWS

GCP

Microsoft Sentinel

Cortex XSOAR

Splunk SOAR

Swimlane

Tines

Job description

Who We Are:

Since 1906, New Balance has empowered people through sport and craftsmanship to create positive change in communities around the world. We innovate fearlessly, guided by our core values and driven by the belief that conventions were meant to be challenged. We foster a culture in which every associate feels welcomed and respected, where leaders and creatives are inspired to shape the world of tomorrow by taking bold action today. This role is open to REMOTE work.

Job Mission

As a member of the Information Security Team, the Senior Vulnerability Management & SOAR Engineer will lead and mature the organization's enterprise Vulnerability Management Program, protecting applications, infrastructure, cloud services, endpoints, containers, and technology platforms from current and emerging threats. This role serves as the primary technical authority for vulnerability discovery, validation, prioritization, remediation coordination, exception management, and security automation. The position partners closely with Infrastructure, Cloud Engineering, Application Development, DevOps, Architecture, Security Operations, and Technology teams to continuously reduce cyber risk through effective vulnerability lifecycle management and operational excellence. Drive accountability across technical teams, improve vulnerability remediation processes, and leverage automation and SOAR technologies to scale program effectiveness, reporting, and risk reduction efforts. This individual contributor role requires both deep technical expertise and strong program ownership, balancing hands‑on vulnerability operations with strategic leadership to continuously strengthen the organization’s security posture.

Role Allocation:

90% Vulnerability Management | 10 % SOAR Engineering & Security. Note: Off-hour support and travel may be required.

Major Accountabilities

Vulnerability Management & Risk Reduction

• Own and continuously mature the enterprise Vulnerability Management Program across on-premises, cloud, containerized, endpoint, network, embedded, and application environments.


• Manage the end-to-end vulnerability lifecycle, including discovery, validation, prioritization, remediation tracking, exception management, verification, and reporting.


• Operate and optimize vulnerability assessment technologies to ensure comprehensive asset coverage and accurate risk visibility.


• Correlate and prioritize findings from vulnerability scanners, application security tools, cloud and container security platforms, attack surface management solutions, and threat intelligence sources.


• Apply risk-based methodologies leveraging CVSS, CISA KEV, exploitability, asset criticality, exposure, and business impact to identify and prioritize the most significant threats.


• Integrate vulnerability management processes with CI/CD pipelines and software delivery workflows to identify and address security weaknesses earlier in the development lifecycle.


• Partner with asset management teams to improve asset inventory accuracy, security coverage, and risk visibility across the enterprise.

Remediation Leadership & Governance

• Coordinate and drive remediation efforts across technical teams to ensure vulnerabilities are addressed within established service-level objectives and/or sensitivity.


• Lead response activities for critical vulnerabilities, zero-day threats, and actively exploited CVEs


• Manage vulnerability exceptions, compensating controls, risk acceptance processes, and periodic exception reviews.


• Develop and maintain vulnerability management policies, standards, procedures, runbooks, and reporting frameworks.


• Create executive and operational metrics measuring risk reduction, remediation, performance, vulnerability trends, asset coverage, SLA adherence, and MTTR.


• Support audits, compliance assessments, and risk management activities through accurate documentation and evidence collection.


• Monitor emerging threats, vulnerabilities, exploit trends, and industry best practices to continuously improve program effectiveness.

SOAR Engineering & Security Automation (10%)

• Design, develop, and maintain SOAR playbooks that automate vulnerability intake, triage, enrichment, ticket creation, remediation tracking, exception handling, and reporting.


• Develop integrations between vulnerability management platforms, SOAR, SIEM, ITSM, CMDB, DevOps, and collaboration platforms.


• Build scripts, APIs, and automated workflows using technologies such as Python, PowerShell, Bash, and REST APIs to improve operational efficiency and reduce manual effort.


• Measure automation effectiveness and recommend technology enhancements that strengthen vulnerability management and security operations capabilities.

Preferred Qualifications

• 5+ years of experience in Vulnerability Management, Security Operations, Security Engineering, Cybersecurity Risk Management, or related security disciplines.


• 3+ years of directly managing or owning enterprise vulnerability management programs in hybrid cloud and on-premises environments.


• Experience administering enterprise vulnerability management platforms such as Tenable, Qualys, Rapid7, Microsoft Defender Vulnerability Management, or equivalent solutions.


• Strong expertise in vulnerability assessment, credentialed scanning, vulnerability validation, risk prioritization, and remediation management.


• Deep understanding of CVE, CVSS, CISA KEV, exploit intelligence, threat intelligence, attack surface management, and risk scoring methodologies.


• Experience with cloud platforms and cloud security technologies including Azure, AWS, or GCP.


• Experience managing vulnerabilities across cloud-native, containerized, and modern application environments.


• Scripting and automation experience using Python, PowerShell, Bash, REST APIs, or similar technologies.


• Experience building security automations using Microsoft Sentinel, Cortex XSOAR, Splunk SOAR, Swimlane, Tines, or similar platforms.


• Familiarity with application security concepts


• Experience developing metrics, KPIs, dashboards, remediation SLAs, and executive reporting for vulnerability management programs.


• Strong understanding of operating systems, network infrastructure, software development processes, and enterprise technology environments.


• Experience supporting compliance frameworks such as NIST, CIS, ISO 27001, SOC 2, PCI-DSS, CMMC, or similar regulatory requirements is preferred.


• Excellent communication and stakeholder management skills with the ability to influence both technical and business audiences.


• Industry certifications such as CISSP, CySA+, Security+, GSEC, GCSA, OSCP, GIAC certifications, or equivalent experience are preferred.

Boston, MA Headquarters - (NB)

Only Pay Range: $104,500.00 - $130,000.00 - $155,500.00 Annual (actual base pay varying based upon, but not limited to, relevant experience, time in role, internal equity, geographic location, and more.)

Regular Associate Benefits

Our products are only as good as the people we hire, so we make sure to hire the best and treat them accordingly. New Balance offers a comprehensive traditional benefits package including three options for medical insurance as well as dental, vision, life insurance and 401K. We also proudly offer a slate of more nontraditional perks – opportunities like online learning and development courses, tuition reimbursement, $100 monthly student loan support and various mentorship programs – that encourage our associates to grow personally as they develop professionally. You’ll also enjoy a yearly $1,000 lifestyle reimbursement, 4 weeks of vacations, 12 holidays and generous parental leave, because work-life balance is more than just a buzzword – it’s part of our culture.

Temporary associates are provided three options for medical insurance as well as dental and vision insurance and an associate discount.

Part time associates are provided 401k, short term disability, a yearly $300 lifestyle reimbursement and an associate discount.

Flexible Work Schedule

For decades we have fostered a unique culture founded on our values with a particular focus on in-person teamwork and collaboration. Our North American hybrid model encourages rich in-person experiences, showcasing our commitment to teamwork and connection, while maintaining flexibility for associates. New Balance Associates currently work in office three days per week (Tuesday, Wednesday, and Thursday). Our offices are fully open, and amenities are available across our North American office locations. To continue our focus on hybrid work we have introduced \"Work from Anywhere\" (WFA) for four weeks per calendar year. This model will help us enhance our culture while continuing to maintain elements of flexibility.

Equal Opportunity Employer

New Balance provides equal opportunities for all current and prospective associates to ensure that employment, training, compensation, transfer, promotion and other terms, conditions and privileges of employment are provided without regard to race, color, religion, national origin, sex, sexual orientation, gender identity, age, handicap, genetic information and/or status as an Armed Forces service medal veteran, recently separated veteran, qualified disabled veteran or other protected veteran, or any other protected status.

At New Balance, our job is to aid athletes in their pursuit of excellence, whether that means helping professional athletes set records and win medals, or propelling everyday athletes to achieve a new PR, run their first 5K or just to live a more healthy and active lifestyle. Our products are the perfect blend of function and fashion, giving you the performance technology you need and the style you want. Our associates around the world bring these goals to life with their high-level skills and creativity. While we offer the best product on the market, we’re also equally committed to giving back. So while we look to succeed, we believe in ensuring others have the same opportunity.