Vulnerability & Attack Surface Lead — Security Ops

OpenLoop; United States; On-site; USD 110,000 - 150,000; Full time

Benefits offered by this job

Healthcare benefits

Hybrid work

401(k) with company match

Generous PTO

Life/Pet Insurance

Job summary

OpenLoop seeks a Vulnerability & Attack Surface Management Analyst II to build and scale security programs across cloud workloads, endpoints, and applications. You will own the end-to-end vulnerability lifecycle, collaborate with engineering teams to ship fixes, and refine risk-based prioritization in a HIPAA-like, high-sensitivity environment.

You will also automate repetitive tasks, manage web app security, and contribute to publishing platform security checks as the org expands its external

Qualifications

• 3 to 6 years in security with hands-on vulnerability management, attack surface management, or cloud security posture management.
• Hands-on experience running and tuning a vulnerability scanning or CNAPP platform.
• Experience prioritizing large findings with a risk-based model; knowledge of CVSS, EPSS, and the CISA KEV catalog.
• Cloud security fundamentals in AWS or GCP; container/image vulnerabilities and SCA findings in code repos.
• Comfort starting with an incomplete inventory and driving ownership across assets.
• Experience collaborating with engineering teams to ship fixes.
• Scripting skills (Python, PowerShell) to query APIs and automate reporting.
• Regular use of AI tools (Claude, ChatGPT, GitHub Copilot) with PHI handling considerations.
• Strong writing for tickets and risk summaries.

Responsibilities

• Run the vulnerability lifecycle end-to-end: discovery, validation, prioritization, remediation tracking, verification, and reporting across cloud workloads, containers, code repos and endpoints.
• Prioritize by actual risk using the risk model; iterate on model with evidence when changes are needed.
• Build a reliable asset inventory integrating cloud, endpoint, and SaaS data with owners.
• Drive remediation by coordinating with Engineering, IT, and Platform teams; write actionable tickets with timelines and escalations.
• Automate repetitive tasks; roll out base images and dependency baselines; connect scanners to ticketing and reporting.
• Own web app security: dynamic scans, coordinate fixes with application teams, use edge/WAF for temporary mitigation.
• Define checks for new publishing platform; ensure inventoried and scanned before going live.
• Manage vulnerability disclosure and bug bounty intake; validate reports and coordinate fixes.

Skills

Vulnerability management

Attack surface mgmt

Cloud security

Risk-based prioritization

Scripting (Python)

AI tools in security

Technical writing

Cross-functional collaboration

CVSS/EPSS knowledge

Tools

Wiz

Orca

Prisma Cloud

Defender for Cloud

Lacework

CrowdStrike Falcon Exposure Management

Jira

Slack

Job description

OpenLoop seeks a Vulnerability & Attack Surface Management Analyst II to build and scale security programs across cloud workloads, endpoints, and applications. You will own the end-to-end vulnerability lifecycle, collaborate with engineering teams to ship fixes, and refine risk-based prioritization in a HIPAA-like, high-sensitivity environment.

You will also automate repetitive tasks, manage web app security, and contribute to publishing platform security checks as the org expands its external