[Hiring] Vulnerability Management Engineer @Backblaze

Role Description

The Vulnerability Management Engineer drives risk-based vulnerability and exposure management across infrastructure, applications, cloud services, endpoints, and software dependencies. The role combines vulnerability data, asset and configuration intelligence, application-security testing, threat intelligence, and AI-assisted analysis to determine whether vulnerabilities are reachable, exploitable, and likely to represent an imminent organizational threat.

Key Responsibilities

• Correlate threat intelligence and vulnerability findings with asset inventory, software configuration, system configuration, application testing, network exposure, ownership, and business criticality.
• Assess exploitability and reachability rather than relying on vulnerability severity alone.
• Incorporate exploit prediction, known exploitation, open-source threat intelligence, adversary activity, and environmental context into prioritization.
• Determine whether exposure requires immediate incident response or remediation under established operational objectives.
• Use AI-assisted workflows to ingest and correlate vulnerability intelligence against the organization's actual technology configuration while independently validating conclusions.
• Partner with Red Team to validate practical exploitability of significant vulnerabilities.
• Identify compensating controls such as configuration changes, access restrictions, segmentation, or filtering when immediate patching is impractical.
• Automate vulnerability ingestion, analysis, prioritization, remediation tracking, mitigation, and verification where appropriate.

Qualifications

• Experience with enterprise vulnerability or exposure management.
• Strong understanding of infrastructure, applications, cloud, containers, networking, and software dependencies.
• Experience interpreting vulnerability intelligence and assessing practical exploitability.
• Knowledge of risk-based prioritization techniques including CVSS, exploit prediction, known-exploitation intelligence, and environmental context.
• Experience correlating vulnerability, asset, configuration, SAST, DAST, SCA, endpoint, or related security data.
• Experience with scripting, automation, or data analysis.
• Familiarity with continuous exposure management, attack-path analysis, AI-assisted analysis, or automated mitigation is preferred.
• Strong understanding of OWASP Top 10, MITRE ATT&CK, MITRE D3FEND, and STRIDE.
• Familiarity with OWASP Top 10 for LLM, OWASP Top 10 for Agentic Applications, MITRE ATLAS and MAESTRO.

Benefits

• Encouragement to apply even if not meeting every requirement.
• Focus on learning, developing, and growing as part of the culture.
• Commitment to diversity, equity, and inclusion.
• Equal Opportunity Employer.