Vulnerability Management Engineer

Workstreet; United States; On-site; USD 90,000 - 130,000; Full time

Job summary

Workstreet is seeking a consultative and hands-on Vulnerability Management Engineer to join our Delivery team. You’ll be the primary security advisor for a portfolio of fast-growth startups, helping them identify, prioritize, and fix risks, including direct patch deployment into AWS, Azure, and GCP.

You will combine scanning infrastructure management with high-touch client advisory, surface critical vulnerabilities using CVSS/EPSS, and work with client IT and DevOps teams to remediate findings

Qualifications

• Hands-on experience triaging and remediating web vulnerabilities.
• Familiarity with Dependabot and software composition analysis.
• Ability to prioritize based on CVSS/EPSS and business impact.
• Experience deploying patches in cloud environments (AWS/Azure/GCP).

Responsibilities

• Triages and prioritizes code vulnerabilities across client repositories.
• Owns remediation pull requests and coordinates fixes with engineers.
• Configures scanning coverage across GitHub orgs and CI/CD tooling.
• Remediates pipeline, container, and infrastructure findings in code.
• Manages exceptions and audit evidence for security controls.
• Acts as primary security advisor for a portfolio of startups.

Skills

Hands-on vulnerability remediation

GitHub Dependabot / SCA tools

Risk prioritization (CVSS/EPSS)

Cloud patching (AWS/Azure/GCP)

Client advisory / consulting

Tools

Tenable

Vanta

GitHub Advanced Security

SCA/SAST tools

Job description

Get to know the Vulnerability Management Team

Our Vulnerability Management team does not stop at the report. We identify, prioritize, and fix vulnerabilities hands-on across client environments, including direct patch deployment into AWS, Azure, and GCP where the vulnerabilities actually live. We work closely with client IT, DevOps, and security teams to move findings from open to closed as efficiently as possible, using risk-based prioritization to make sure the right things get fixed first. Ownership and follow-through define how we operate: a scan result without a remediated finding is an unfinished job. If you want to be the person who closes the loop rather than hands it off, this is your team.

The Opportunity

We are seeking a consultative and hands-on Vulnerability Management (VM) Engineer to join our elite Delivery team. At Workstreet, our work doesn't stop at handing over a scan report-ownership and complete follow-through define how we operate. You will serve as the primary security advisor for an assigned portfolio of fast-growth startups, helping them identify, prioritize, and fix risks.

In this role, you will seamlessly combine scanning infrastructure management with high-touch client advisory. Using tools like Vanta, Tenable, and risk prioritization models (CVSS/EPSS), you will surface critical vulnerabilities. Instead of just passing off the findings, you will work directly with client IT and DevOps teams to deploy patches right where the vulnerabilities live in AWS, Azure, and GCP. If you want to be the person who closes the loop from scan to fix rather than just passing the buck, this is your team.

What You'll Do

• Triage and Prioritize Code Vulnerabilities: Work through Dependabot alerts, code scanning results, and secret scanning alerts across client repositories. Determine whether a vulnerable package or code path is reachable and exploitable in the client's application, dismiss false positives with documented rationale, and rank findings using CVSS, EPSS, CISA KEV status, and the client's asset and data context.
• Own Remediation Pull Requests: Review, test, and merge Dependabot pull requests, and open your own for upgrades Dependabot cannot handle, such as transitive dependencies, major version bumps, and breaking changes. Apply straightforward code and configuration fixes directly, and give engineers clear written guidance on fixes that need design changes. Work with client engineers through code review and release processes to meet a sub-30-day time-to-remediate target.
• Configure and Maintain Scanning Coverage: Enable and tune Dependabot, code scanning, and secret scanning across client GitHub organizations, including repository coverage, alert rules, update grouping, and ignore rules. Maintain scanning of container images, CI/CD pipelines, and Terraform using tools such as Wiz, and connect findings to Vanta so coverage gaps are visible.
• Remediate Pipeline, Container, and Infrastructure Findings: Fix vulnerabilities in base images, GitHub Actions workflows and other CI/CD configuration, and Terraform-defined infrastructure by changing the code rather than the console. Where required, deploy patches to systems hosted in AWS, Azure, and GCP.
• Manage Exceptions and Audit Evidence: Document, verify, and track client requests for temporary vulnerability exceptions and long-term risk acceptances, including dismissed alerts and accepted dependency risks. Map remediation data, such as alert history, pull request records, and time-to-remediate metrics, to the control evidence required for SOC 2, ISO 27001, HIPAA, CMMC, and NIST audits.
• Own the Advisory Client Experience: Act as the primary point of contact and trusted security advisor for an assigned portfolio of fast-growth startups. Deliver regular project milestones, handle high-priority technical escalations with calm professionalism, and produce status reports and executive summaries that communicate technical risk as business value.

Who you are

• Application vulnerability engineer: You have hands-on experience triaging and remediating vulnerabilities in web applications and their dependencies, and you have worked with GitHub Dependabot and GitHub Advanced Security, or with comparable software composition analysis (SCA) and static analysis (SAST) tools.
• Comfortable in code: You can read and modify code in at least one common web language such as JavaScript or TypeScript, Python, Java, or Go. You understand package managers, lockfiles, semantic versioning, and transitive dependencies, and you are comfortable opening a pull request, running tests, and resolving merge conflicts.
• Risk prioritizer: You use CVSS base scores, EPSS exploit probability, CISA KEV, and reachability analysis to decide what gets fixed first, and you can explain the ranking to a founder or engineering lead.
• Precision threat analyst: You validate scanner output, eliminate false positives, and understand common web vulnerability classes, including injection, cross-site scriptin