Job Closed
This listing is no longer active.
Point-of-sale payment platform
Vulnerability Management Security Engineer
Location
Texas
Posted
95 days ago
Salary
0
Seniority
Senior
Job Description
Vulnerability Management Security Engineer
Katapult
• Own the vulnerability management lifecycle and operating model: asset discovery, authenticated scanning, validation/triage, risk-based prioritization, remediation tracking, and exception handling • Administer and tune vulnerability scanning tools (e.g., Tenable/Qualys/Rapid7), including scan policies, schedules, credentials, coverage monitoring, and false-positive reduction • Maintain accurate vulnerability scope by partnering with IT and outsourced IT to improve inventory/CMDB data, ownership, tagging, and coverage for servers, endpoints, network devices, and cloud resources • Drive remediation with system owners by translating technical findings into actionable tickets, validating fixes, and escalating overdue/high-risk items based on defined SLAs • Define vulnerability remediation standards (severity definitions, SLAs, exception criteria) and manage the risk acceptance/exception process with appropriate approvals and audit-ready evidence • Coordinate patch and configuration remediation activities with internal IT and outsourced IT, including maintenance windows, validation scans, and change control documentation • Produce executive-ready risk reporting and program metrics (dashboards/scorecards); communicate trends, exposure drivers, and remediation performance to leadership and technical teams • Support secure configuration and hardening efforts by aligning remediation guidance to recognized standards (e.g., CIS Benchmarks, vendor guidance) and validating compliance via scanning and spot checks • Coordinate external penetration tests and vulnerability assessments; intake findings, assist with remediation plans, and track closure through retesting • Perform vulnerability validation and prioritization, including exploitability context (e.g., KEV/exploit intel), business criticality, and exposure (internet-facing, privilege level, lateral movement) • Lead rapid exposure assessments and remediation coordination for emerging threats (e.g., zero-days, CISA KEV additions), including stakeholder communications and mitigation tracking • Partner with Security Operations (SOC) and Incident Response to perform rapid exposure assessments during emerging threats and support containment/mitigation actions as needed • Manage vulnerability-related tickets/workflows in the organization’s service management platform (e.g., ServiceNow/Jira), including SLA tracking, evidence collection, and audit-ready documentation • Lead continuous improvement for vulnerability management, including automation, coverage expansion, authenticated scanning maturity, and integrations with patching/endpoint management, CMDB, and ticketing systems • Provide security oversight and governance for outsourced IT/MSP vulnerability remediation deliverables (patching, endpoint protection, scanning credential management, hardening), including KPI/SLA review, quality assurance, and escalations • Lead vendor and outsourced IT coordination to ensure timely remediation and accurate reporting; define expectations, participate in QBRs, and manage escalations for recurring security gaps • Own and improve Microsoft 365 security and identity controls relevant to vulnerability reduction (e.g., Entra ID, Conditional Access, MFA, privileged access/secure admin practices, security baselines) in coordination with IT • Own Proofpoint email security configuration and tuning for Office 365/Exchange Online mail flow (e.g., anti-spam/anti-malware, URL defense, attachment sandboxing, anti-phishing/BEC protection), including incident-driven rule updates, metrics/reporting, and continuous reduction of false positives/negatives
Job Requirements
- Bachelor’s Degree in Computer Science (or equivalent)
- Relevant security certification preferred (e.g., Security+, SSCP, CISSP, or GIAC)
- Relevant technical certification preferred (e.g., OSCP/OSCE, GIAC (GSEC/GPEN/GCIH), Microsoft SC-200/SC-300/SC-100)
- 6+ years of experience in vulnerability management, security engineering, or a closely related cyber security role
- Hands-on experience with vulnerability management platforms and scanners (e.g., Tenable, Qualys, Rapid7) and interpreting CVEs/CVSS and vendor advisories
- Demonstrated experience defining vulnerability prioritization models, remediation SLAs, and governance (exceptions/risk acceptance), including executive-ready reporting and metrics
- Strong working knowledge of Windows and Linux patching/configuration, endpoint management, and common enterprise infrastructure (AD/Entra ID, virtualization, networking, cloud services)
- Experience with Microsoft 365 security administration and Exchange Online mail flow concepts, plus hands-on experience administering or partnering on Proofpoint email security filtering and policy tuning
- Experience managing or overseeing outsourced IT providers/MSPs, including ticket quality, SLA performance, security deliverables, and escalation management
- Proven ability to influence and drive remediation across teams (including outsourced providers) without direct authority; excellent written and verbal communication with technical and executive stakeholders
- Ability to mentor teammates and uplift partner teams by providing clear remediation guidance, repeatable runbooks, and training on vulnerability management processes
- Ability to analyze data, validate findings, and independently drive tasks to closure with sound judgment and attention to detail
- Familiarity with ticketing/workflow tools (e.g., ServiceNow/Jira) and producing audit-ready evidence of remediation and exceptions
- Scripting/automation skills (PowerShell and/or Python) to support reporting, data normalization, and process automation
Benefits
- Competitive benefits package
- Opportunities for career advancement
Related Guides
Related Categories
Related Job Pages
More Security Engineer Jobs
Cybersecurity Shift Lead
CyberMaxxCyberMaxx prevents, detects, and responds to cyberattacks so organizations can have peace of mind.
• Lead and coordinate SOC analysts during assigned shift, ensuring adherence to procedures and performance expectations. • Serve as the first line of escalation for high-priority or complex security incidents. • Oversee real-time monitoring, analysis, and triage of security alerts from various security platforms. • Validate and ensure completeness, accuracy, and consistency of incident documentation and ticketing. • Enforce adherence to playbooks, runbooks, and service level agreements (SLAs). • Provide shift handoff summaries and briefings to incoming teams and SOC leadership. • Mentor and coach team members to drive continuous skill development and career progression. • Assist with onboarding of new analysts and ensure proper access to customer environments. • Participate in operational planning and post-incident reviews to identify improvements. • Collaborate across internal teams to support customer onboarding, tuning, and custom configurations. • Maintain awareness of emerging threats, vulnerabilities, and security technologies.
• Support Data Center security design and installation projects throughout North America • Manage all aspects of the project from initial engagement through project completion • Manage multiple projects and scopes of work • Identify project schedule, scope parameters, and oversee security design and implementation per client design requirements and standards • Manage early project initiation activities and develop project security scope, schedule, critical deliverables, and requirements • Manage scheduling, status, and tracking of critical project tasks, issues, and deliverables • Prepare, issue, and manage Request for Proposal (RFP) documents for security systems installation scope • Evaluate RFP responses and prepare evaluation reports • Perform security site evaluations of potential client properties and review proposed design concepts • Review all security system design documentation for compliance with published security requirements • Accountable for keeping clients informed of project status, including budget, schedule, issues, etc. • Serve as a primary security point of contact for project teams and stakeholders • Produce project status and issues reports and meet with client stakeholders weekly
Data Security Engineer
OrangeOrange Business est un intégrateur réseau et numérique qui comprend toute la chaîne de valeur du monde digital, permettant à nos clients de se concentrer sur les initiatives stratégiques qui font avancer leur business. Chaque jour, vous collaborerez avec une équipe dédiée à la livraison de solutions globales cohérentes et durables, peu importe où nos clients opèrent. Avec plus de 30 000 salariés en Europe, Asie, Amérique et Afrique Nous proposons un environnement dynamique et innovant permettant de développer et affiner vos compétences Nous offrons des opportunités passionnantes dans la data et le digital, le cloud, l'IA, la cybersécurité, ou encore l'IoT et le digital workspace
Role Description En mission interne au sein de l’unité d’élite « Solutions Cockpit » de la direction « Trust » d'Orange Business Services, vous intégrerez une équipe spécialisée dans la fourniture de solutions de confiance pour des clients très sensibles, notamment dans les secteurs « Défense & Sécurité ». Votre rôle principal sera de répondre aux besoins des clients « Trust » en matière de sécurité des données et de reporting, en mettant en place et en améliorant les outils et processus nécessaires. Vous participerez à toutes les phases du projet : du Think, au Build, en passant par le Run, pour suivre le projet dans sa globalité. - Surveiller et analyser les logs à l’aide d’outils tels qu'Elastic / OpenSearch et Logstash. - Concevoir et déployer des dashboards, automatiser les processus métiers et/ou clients (notion de templates). - Contribuer à la mise en place et à l’amélioration des mesures de sécurité. - Collaborer avec les équipes techniques pour intégrer des pratiques de sécurité robustes. - Participer à l’automatisation des processus de sécurité via l’intégration continue. - Analyser et répondre aux incidents de sécurité en collaboration avec le SOC (Security Operations Center). Qualifications - Titulaire d’un diplôme de niveau Bac+5, avec une première expérience dans un environnement de sécurité. - Forte capacité à travailler dans un contexte nécessitant confidentialité et rigueur, tout en étant orienté service et collaboration. Requirements - Maîtrise obligatoire d’Elastic / OpenSearch et Logstash. - Connaissance de l’environnement Debian appréciée. - Expérience en intégration continue (CI). - Connaissances en réseaux. - Expérience avec les SOC et cyber SOC, la supervision et la métrologie. Benefits - Ce poste est soumis à une habilitation spécifique dans le domaine d’activité concerné, nécessitant la signature d’un avenant à votre contrat. - Un parcours d’accompagnement sera mis en place avec nos meilleurs agents, et un(e) « buddy » vous accompagnera lors de votre intégration. Company Description Orange Cyberdefense est l’entité stratégique du Groupe Orange dédiée à la sécurité numérique. Nous accompagnons les entreprises de toutes tailles, organismes critiques, administrations et collectivités locales dans la conception de leurs stratégies de cybersécurité, leur mise en œuvre et leur gestion opérationnelle. Nous leur apportons notre expertise afin d’assurer le meilleur niveau de protection de leurs données, de leurs équipements et des services qu’ils offrent à leurs clients ou leurs administrés. Avec un CA de 1,3 Md€ en 2025, 7% de croissance et plus de 3.300 experts dédiés à la cybersécurité, nous nous positionnons aujourd'hui comme le Leader européen sur le marché de la cyberdéfense. Notre vocation est de construire une société numérique plus sûre.
Set the standards for how we use LLMs, MCP servers, and agentic tooling without leaking data, over-per missioning agents, or shipping prompt-injectable surfaces. Stay current on a threat landscape that's changing monthly.
