Vulnerability & Attack Surface Management Analyst II

openloophealth; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Medical, dental, vision

HSA/FSAs

Generous PTO (hybrid)

401(k) with match

Life and pet insurance

Job summary

openloophealth is seeking a security operations role focused on vulnerability and attack surface management. You will own the day-to-day program, report to a Director, and work to shrink a growing backlog to the issues that truly matter while ensuring fixes are verified.

You will run the full vulnerability lifecycle across cloud workloads, containers, code repositories, and endpoints, prioritizing findings with risk signals and documenting deferrals.

Qualifications

• 3–6 years in security with hands-on vulnerability management or cloud security posture.
• Direct experience operating and tuning a vulnerability scanner or CNAPP platform.
• Risk-based prioritization using CVSS/EPSS and CISA KEV.
• Cloud security fundamentals in AWS or GCP, with container or SCA findings.
• Comfort with incomplete inventory and ownership mapping.
• Proven track record shipping fixes with engineering teams; scripting in Python/PowerShell.
• Experience using AI assistants in security with safe data practices.

Responsibilities

• Run the full vulnerability lifecycle across cloud workloads, containers, code repos, and endpoints.
• Prioritize findings with a risk model and document deferrals.
• Build and maintain a unified asset inventory with named owners.
• Drive remediation by coordinating with engineering and IT teams; create actionable tickets.
• Address root causes via hardened images, dependencies, and automation linking scanners to tickets.
• Lead web app security, including dynamic scans and WAF mitigations; track disclosures.
• Stand up checks for an internal app publishing platform to inventory and scan internally built apps.

Skills

Vulnerability mgmt

CNAPP operations

Risk prioritization

CVSS/EPSS knowledge

CISA KEV

Python scripting

PowerShell scripting

Cloud security

Tools

Wiz

Orca

Prisma Cloud

Defender for Cloud

Lacework

CrowdStrike Falcon

Tenable

Qualys

Rapid7

Job description

Role overview

This is a newly created, full-time position on a security operations team that protects patient data and clinical systems for a healthcare organization subject to HIPAA. You will be the first person dedicated to vulnerability and attack surface management, owning the day-to-day program while reporting to a Director who sets strategy. Success looks like shrinking a large, fast-growing finding backlog into the handful of issues that actually matter and verifying that fixes have landed.

Responsibilities

• Run the full vulnerability lifecycle across cloud workloads, containers, code repositories, and endpoints, from discovery through verification.
• Prioritize findings using a risk model that weighs internet exposure, exploitability signals like CISA KEV and EPSS, asset criticality, and data sensitivity, and document when items are deliberately deferred.
• Build and maintain a unified asset inventory spanning cloud, endpoint, and SaaS, ensuring every meaningful asset has a named owner.
• Drive remediation through engineering, IT, and platform teams by writing actionable tickets, agreeing on timelines, escalating blockers, and confirming fixes.
• Address root causes through hardened base images, dependency baselines, and automation that connects scanner and CNAPP APIs to ticketing and reporting.
• Lead web application security, including dynamic scans, edge and WAF mitigations, and tracking for vulnerability disclosure or bug bounty reports.
• Stand up security checks for an internal application publishing platform so internally built, externally published apps are inventoried and scanned.

Requirements

• 3 to 6 years in security, with hands-on time in vulnerability management, attack surface management, or cloud security posture.
• Direct experience operating and tuning a vulnerability scanning or CNAPP platform, not only reading its output.
• Practical risk-based prioritization skills, with working fluency in CVSS, EPSS, and the CISA KEV catalog and an opinion on how they combine.
• Cloud security fundamentals in at least one major provider, ideally GCP or AWS, including container and dependency or SCA findings in code.
• Comfort working from an incomplete inventory and figuring out what exists and who owns each asset.
• A track record of working directly with engineering teams to ship fixes, plus scripting skills in Python, PowerShell, or similar to query APIs and automate reporting.
• Hands-on use of AI assistants in security work, with concrete examples and discipline around what data is safe to share.

Nice to have

• Specific experience with Wiz, or comparable CNAPP and VM platforms such as Orca, Prisma Cloud, Defender for Cloud, Lacework, CrowdStrike Falcon Exposure Management, Tenable, Qualys, or Rapid7.
• Attack surface and CAASM tooling such as Axonius or runZero, plus external discovery techniques including DNS, certificate transparency, and subdomain enumeration.
• DAST and edge or WAF platforms like Invicti, Burp Suite, Cloudflare, or Akamai, and experience running a vulnerability disclosure or bug bounty program.
• Hardened base image programs, Kubernetes and container security at scale (GKE or EKS), PaaS or edge hosting, SBOMs, and supply chain security work.
• Regulated industry experience with HIPAA, HITRUST, or SOC 2, especially supplying vulnerability evidence to auditors and customers.
• Relevant certifications such as GCLD, GCPN, GWEB, GSEC, cloud security specialty, or OSCP.

Benefits and work setup

• Competitive compensation
• Medical, dental, and vision coverage
• Flexible spending and health savings accounts
• Generous PTO with hybrid work flexibility
• 401(k) with company match
• Life insurance, pet insurance, and additional benefits