Vulnerability & Attack Surface Lead — Hybrid

OpenLoop Health; United States; Hybrid; USD 110,000 - 140,000; Full time

Benefits offered by this job

Competitive compensation

Medical, Dental & Vision

Flexible Spending / Health Savings

Generous PTO and hybrid-work

401(k) with Company Match

Life Insurance

Pet Insurance

Job summary

OpenLoop Health is building a Vulnerability & Attack Surface Management program to protect PHI and HIPAA-relevant systems. You will own the lifecycle from discovery to remediation, prioritize risks, build a unified asset view, and drive fixes across engineering, IT, and platform teams.

You’ll leverage CNAPP integrations, AI tools, and dynamic scans to reduce exposure while coordinating with auditors and clients.

Qualifications

• 3–6 years in security with vulnerability mgmt, ASM, or cloud security posture management.
• Hands-on experience with vulnerability scanning / CNAPP platforms.
• Ability to prioritize a large findings set using a risk-based model (CVSS/EPSS/CISA KEV).
• Cloud provider fundamentals (GCP/AWS), container and image vulnerabilities, SCA in code repos.
• Experience shipping fixes with engineering teams; automation of reporting and checks.

Responsibilities

• Run the vulnerability lifecycle day to day: discovery, validation, prioritization, remediation tracking, verification, and reporting across cloud workloads, containers, code repos, and endpoints.
• Prioritize by actual risk using the risk model; adjust priorities with evidence when needed.
• Build a reliable asset inventory spanning cloud, endpoint, and SaaS, with asset ownership.
• Drive remediation through Engineering, IT, and Platform teams; write actionable tickets with realistic timelines.
• Automate repetitive work and roll out base images and dependencies to close many findings.
• Own web application security; run dynamic scans and coordinate fixes with app teams.
• Set up checks for the publishing platform; inventory and scan apps before go-live.
• Manage vulnerability disclosure and bug bounty intake; validate, respond, and verify fixes.
• Use AI tools daily to triage findings, draft remediation guidance, and produce reports.
• Track metrics like mean time to remediated and backlog burn-down; support client/auditor requests.

Skills

Vulnerability mgmt

Attack surface mgmt

Cloud security

Scripting (Python/PowerShell)

AI tools usage

Technical writing

Tools

Wiz

Jira

Job description

OpenLoop Health is building a Vulnerability & Attack Surface Management program to protect PHI and HIPAA-relevant systems. You will own the lifecycle from discovery to remediation, prioritize risks, build a unified asset view, and drive fixes across engineering, IT, and platform teams.

You’ll leverage CNAPP integrations, AI tools, and dynamic scans to reduce exposure while coordinating with auditors and clients.