Vulnerability & Attack Surface Strategy Analyst II

Openloop-Health; Des Moines (IA); On-site; USD 90,000 - 120,000; Full time

Job summary

OpenLoop is seeking a Vulnerability & Attack Surface Management Analyst II to help build and run our security program. You’ll own the vulnerability lifecycle, manage exposure and remediation across cloud workloads, code repos, and endpoints, and drive risk-based decisions with cross-functional partners.

Reporting to the Director of Information Security, you’ll shape prioritization, scale an evolving platform, and leverage AI tools to triage findings while protecting PHI under HIPAA.

Qualifications

• 3–6 years in security with significant hands-on vulnerability management or ASM experience.
• Hands-on experience running and tuning a vulnerability scanning or CNAPP platform.
• Experience prioritizing findings with a risk-based model; familiarity with CVSS, EPSS, and CISA KEV.
• Cloud security fundamentals (GCP or AWS) and container/image vulnerability awareness.

Responsibilities

• Run the vulnerability lifecycle from discovery to reporting across cloud workloads and endpoints.
• Prioritize by real risk, refine the risk model, and escalate decisions when needed.
• Build and own a comprehensive asset inventory with owners for critical assets.
• Drive remediation by coordinating with engineering, IT, and platform teams.
• Automate repetitive tasks and connect scanners to ticketing and reporting workflows.
• Own web app security: run DAST and coordinate fixes with application teams.
• Ensure security checks for new publishing platforms before go-live.
• Manage vulnerability disclosures and coordinate responses with researchers.

Skills

Vulnerability management

Attack surface management

Cloud security

Scripting (Python/PowerShell)

Risk-based prioritization

Stakeholder communication

Tools

Wiz

GCP

AWS

Job description

OpenLoop is seeking a Vulnerability & Attack Surface Management Analyst II to help build and run our security program. You’ll own the vulnerability lifecycle, manage exposure and remediation across cloud workloads, code repos, and endpoints, and drive risk-based decisions with cross-functional partners.

Reporting to the Director of Information Security, you’ll shape prioritization, scale an evolving platform, and leverage AI tools to triage findings while protecting PHI under HIPAA.