[Hiring] Senior Engineer, Exposure & Vulnerability Management @Recursion

Role Description

Your work will change lives. Including your own.

Help shift Recursion from periodic scans to continuous, risk-driven exposure management. You’ll build multi-agent systems that take vulnerabilities from discovery to verified closure, with approval gates, audit trails, and rollback built in. You’ll replace static CVSS scores with prioritization based on reachability, attack paths, business criticality, and live exploit intelligence, so engineering teams can focus on what’s actually exploitable. By integrating remediation into ticketing and CI/CD and partnering with Engineering and IT to make secure-by-default the norm, you’ll shrink our attack surface and speed up fixes where risk is highest, helping Recursion keep decoding biology with confidence.

In this role, you will:

• Design and deploy multi-agent systems that take an exposure from discovery to closure: analyzing it from the outside in, mapping dependencies from the inside out, generating the patch or Infrastructure-as-Code (IaC) update, and validating the result.
• Build in approval gates, audit trails, and rollback so every automated change gets the level of review its risk calls for.
• Move prioritization beyond static CVSS scores by building engines that rank exposures on real-time reachability, attack-path context, business criticality, and live exploit intelligence.
• Cut through alert noise with automated verification that separates theoretical flaws from actively exploitable conditions, so engineering and DevOps teams can focus on the issues that matter.
• Drive our Continuous Threat Exposure Management (CTEM) strategy, shifting the organization from periodic scans to a proactive, around-the-clock security posture across products, platforms, cloud and on-premise infrastructure, and corporate applications.
• Assess the current state of our exposure and vulnerability management program and revamp the strategy to accelerate key business outcomes and support our broader zero-trust security approach.
• Architect cloud-native discovery, asset-inventory, and remediation workflows, and integrate them with ticketing, CI/CD, and configuration management so fixes reach owners and ship without manual hand-offs.
• Partner with Engineering and IT to embed secure-by-default practices into how products and applications are built, deployed, and patched, with remediation timelines matched to real risk.
• Define KPIs, KCIs, and KRIs (for example mean time to remediate, exploitable-exposure backlog, and coverage of critical assets) that show how well controls are working and guide continuous improvement.
• Support regulatory compliance by working with partner teams to design exposure and vulnerability controls that meet standards such as SOC2.

Qualifications

• Bachelor's or Master's degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
• 7+ years of experience in vulnerability management, exposure management, or related information security domains, including leading large-scale programs from strategy through execution in cloud-first and hybrid environments.
• Deep understanding of security principles, with a track record of turning vulnerability data into prioritized, owned, and verified remediation.
• Hands-on experience building or deploying AI/LLM-based agents or multi-agent systems for security or engineering workflows, including orchestration, tool use, and evaluation.
• Working knowledge of approval workflows, audit logging, and rollback controls for automated remediation, and of the risks of agent-driven changes.
• Proficiency in one or more programming languages (for example Python, Go, Java) and strong scripting skills for automation and integration.
• Expert-level experience with leading vulnerability and exposure management platforms (for example Tenable, Qualys, Rapid7, or equivalent) and with CTEM, attack surface management, and attack-path analysis tooling.
• Strong command of risk-based prioritization: CVSS, EPSS, CISA KEV, reachability analysis, and threat intelligence feeds.
• Experience with cloud platforms (AWS, Azure, GCP), container and Kubernetes security, and Infrastructure-as-Code (Terraform, CloudFormation) for automated remediation.
• Experience with CI/CD pipelines, SCA/SAST tooling, and software supply chain security, including SBOMs and dependency mapping.
• Knowledge of operating systems (UNIX/Linux, macOS, Windows), networking, and database management systems.
• Experience with risk management, ensuring solutions align with organizational risk tolerance and compliance requirements (SOC2, GxP, or similar).
• Relevant security certifications (for example CISSP, OSCP, GWAPT) are highly desirable.

Requirements

• This is a remote position based in the United States.
• We ask that remote employees commit to regular on-site visits for routine work and departmental events.

Benefits

• Estimated annual base salary range: $134,200–$180,600.
• Eligible for an annual bonus, equity compensation, and a comprehensive benefits package.

Company Description

Recursion (NASDAQ: RXRX) is a clinical-stage TechBio company decoding biology to radically improve lives. Recursion is advancing a portfolio of differentiated investigational medicines across its wholly owned and partnered pipeline in oncology, rare disease, neuroscience, immunology, and other therapeutic areas with significant unmet need.

Enabling its mission is the Recursion OS, an AI-native, end-to-end drug discovery and development platform integrating biology, chemistry, and clinical development into a unified intelligence system.

Recursion’s platform infrastructure is anchored in Salt Lake City, Utah and Milton Park, Oxfordshire, where its automated biology and chemistry laboratories generate proprietary data at industrial scale.

Recursion also maintains offices in New York, Montréal, and London, three global hubs for talent and leadership at the intersection of AI and scientific innovation.