Vulnerability Management & AppSec Engineer

SoFi; San Francisco (CA); On-site; USD 140,000 - 210,000; Full time

Job summary

SoFi is seeking a Vulnerability Management Engineer to identify, assess, prioritize, and remediate risks across applications and infrastructure. You will help track fixes, build tooling, and document processes while growing AppSec expertise and using AI tools for efficiency.

The role requires experience with CVE, CVSS, OWASP, DAST/SAST, and at least one coding language (Bash, Python, Java or Go), in a fast-paced, collaborative environment.

Qualifications

• Bachelor’s degree or equivalent in CS/IS or related field.
• Deep knowledge of CVE, CVSS, OWASP and vulnerability concepts.
• Experience with vulnerability assessment tools and DAST/SAST.
• Strong communication for technical and non-technical stakeholders.

Responsibilities

• Perform regular vulnerability assessments and drive remediation and reporting.
• Prioritize scope, impact, and actions for discovered vulnerabilities.
• Conduct security reviews of products and production infrastructure.
• Contribute to vulnerability management, app security and red-team activities.
• Engage in security audits and regulatory exercises with partners.
• Support compliance monitoring and reporting.
• Coordinate remediation with owners and system contacts.
• Develop processes and documentation to improve efficiency.

Skills

Vulnerability management

Communication skills

Bash

Python

Java

Go

Education

Bachelor’s Degree in Computer Science / Information Systems / equivalent

Masters or PhD in CS or Engineering (nice to have)

Tools

DAST/SAST tools

CI/CD tools

AWS

Claude AI tooling (documentation & scripting)

Job description

SoFi is seeking a Vulnerability Management Engineer to identify, assess, prioritize, and remediate risks across applications and infrastructure. You will help track fixes, build tooling, and document processes while growing AppSec expertise and using AI tools for efficiency.

The role requires experience with CVE, CVSS, OWASP, DAST/SAST, and at least one coding language (Bash, Python, Java or Go), in a fast-paced, collaborative environment.