[Hiring] Senior Information Security Engineer @IRIS

Role Description

The Senior Information Security Engineer - Vulnerability Management will be responsible for:

• Owning the end-to-end vulnerability management lifecycle across products and supporting technology, from identification and validation through prioritisation, remediation tracking, risk acceptance and reporting.
• Triage and validate findings from multiple sources, including SAST, DAST, SCA, secrets scanning, penetration testing and web application scanning.
• Working closely with Engineering and Product teams to drive remediation of vulnerabilities, helping teams understand technical risk, agree appropriate remediation actions and meet defined remediation timelines.
• Partnering with teams responsible for integrating security tooling into CI/CD pipelines, improving the quality, coverage and effectiveness of that tooling.
• Developing and continuously improving risk-based vulnerability prioritisation, considering exploitability, asset exposure, business criticality, threat intelligence and compensating controls.
• Identifying recurring vulnerability patterns and root causes, working with engineering teams to reduce systemic weaknesses.
• Continuously improving vulnerability management processes, dashboards and workflows, bringing strong technical ownership and ideas for scalability and effectiveness.
• Supporting the security review of software supply chain risks, including dependency management, build pipeline security and relevant secure software development practices.
• Reviewing and validating findings from cloud security and CSPM platforms, helping Infrastructure and Engineering teams prioritise and remediate cloud vulnerabilities and configuration weaknesses.
• Researching emerging cloud threats, vulnerabilities and misconfiguration patterns and recommending appropriate mitigations.
• Supporting the implementation and improvement of cloud security controls and security baselines where required.

Qualifications

• Strong technical background in application security, vulnerability management or software engineering.
• Practical experience with security tooling such as SAST, DAST, SCA and secrets scanning.
• Comfortable with software supply chain security, including frameworks such as SLSA, dependency security and secure build pipelines.
• Solid grounding in public cloud security, particularly across AWS and/or Azure.

Requirements

• Ability to assess vulnerabilities in context, weighing exploitability, internet exposure, asset criticality, available exploits and compensating controls.
• Recognition of recurring vulnerabilities in cloud environments, including overly permissive identities and exposed services.

Benefits

• Your work will influence millions globally.
• Continuous learning and career development opportunities.
• A culture that celebrates diversity and empowers every individual.