Security Engineer - Vulnerability Management

Role: Security Engineer - Vulnerability Management

Location: Mountain View CA (100% Onsite)

C2C

DETAILED JOB DUTIES

Skill Set for Security Engineer - Vulnerability Management Role

Must-Have Skills (Non-Negotiable) Vul. Mgmt

1. Identify, Analyze, and Prioritize the Impact of Vulnerabilities
1. Assess and prioritize vulnerabilities based on real-world impact.
2. Examples: Using risk-based factors beyond CVSS, incorporating threat intelligence and environmental factors.
3. Tools: OWASP, SANS 25, AWS Security Hub, Tableau, Qlik Sense for risk assessment.
2. Mitigation if Patch is Not Ready
1. Implement compensating controls and temporary mitigations for unpatched vulnerabilities.
2. Examples: Using WAF rules, network segmentation, access controls until a patch is available.
3. Tools: AWS, Kubernetes, Docker Security Measures, Advanced WAF Configurations.
3. Automating Future Detection
1. Develop and implement automated detection mechanisms for vulnerabilities.
2. Examples: Automating scans, continuous vulnerability assessment, and reporting.
3. Tools: Python, Java, Ruby, Node, AWS Security Hub, JIRA, ServiceNow.
4. Detecting Malicious Payloads
1. Identify and prevent malicious payloads before execution.
2. Examples: Using threat intelligence and behavioural analytics for payload detection.
3. Tools: CrowdStrike, AWS GuardDuty, SIEM solutions.
5. Blocking Advanced WAF Evasion Techniques
1. Enhance Web Application Firewall (WAF) security to detect and block advanced evasion attempts.
2. Examples: Implementing custom WAF rules and monitoring attack patterns.
3. Tools: AWS WAF, Cloudflare, ModSecurity, Imperva.
6. Automating Threat Responses
1. Automate incident response workflows for detected vulnerabilities.
2. Examples: Using security playbooks to trigger automated remediation actions.
3. Tools: AWS Lambda, Python automation, SIEM integrations.
7. Risk-Based Factors Beyond CVSS
1. Consider additional risk factors beyond CVSS scores when prioritizing vulnerabilities.
2. Examples: Evaluating exploitability, business impact, attack surface exposure.
3. Tools: Threat intelligence feeds, vulnerability management dashboards.

Good-to-Have Skills (Preferred but Not Mandatory) Vul. Mgmt

1. Cloud Security & Container Security
1. Secure AWS, Google Cloud Platform, Kubernetes, Docker environments.
2. Data Analytics for Security Posture Improvement
1. Utilize Tableau, Qlik Sense, SQL for security data analysis.
3. Experience in Influencing Secure Software Development
1. Work with developers to build security-first applications.