Vulnerability Management & Security Controls Engineer

AVG

Tempe (AZ)

On-site

USD 110,000 - 160,000

Full time

14 days+

Application generator

Turn this role into an interview — a resume and cover letter built around what this employer wants.

Get past ATS filters

Job summary

Gen is seeking an independent security professional who thrives at the intersection of security, DevOps, and delivery. You will translate legal and security requirements into actionable vulnerability management programs that operate across Security and DevOps teams.

You will design and improve the vulnerability management lifecycle from identification to remediation, integrate SAST/DAST/SCA into CI/CD, and collaborate with a Senior PM to align scope, timelines and reporting to senior leadership.

Qualifications

A degree in IT or a related field, ideally with a focus on cybersecurity.
3+ years in vulnerability management, security engineering, or security program delivery in a cloud/software environment.
Ability to work independently and drive outcomes across multiple teams.
Understanding of regulatory security requirements and demonstrated experience with frameworks (ISO 27001, NIS2, SOC 2, GDPR, PCI DSS).
Strong translation skills: turn policy into developer-ready user stories, acceptance criteria, remediation tasks, and runbooks.
Hands-on with work tracking tools (Jira, Azure DevOps) and crafting leadership dashboards.
Strong communication; able to analyze vulnerability trends and root causes.
Understanding of modern SDLC/DevOps practices (CI/CD, IaC).
Experience in cloud environments (AWS/Azure/GCP).
Wry sense of humor is a plus.

Responsibilities

Translate requirements into prioritized, testable tasks for engineering and platform teams.
Own the vulnerability management lifecycle across infrastructure, cloud, apps, containers, and third‑party components.
Integrate security into CI/CD with SAST, DAST, SCA, container, IaC, and cloud configuration scanning.
Coordinate work across multiple security domains and DevOps/Platform teams.
Build delivery plans, track milestones, manage dependencies, and maintain Jira/Azure Boards.
Align with product owners, architects, and security SMEs; resolve blockers.
Develop actionable dashboards showing vulnerability aging, SLAs, backlog trends and risk.
Map vulnerability practices to regulatory frameworks and collect evidence for audits.
Standardize templates and automate playbooks to reduce manual triage.
Work with a Senior PM to align scope, timelines, and deadlines.