[Hiring] Principal Vulnerability Management Engineer @Rite Aid

Role Description

The Vulnerability Management (VM) program focuses on addressing vulnerabilities in the entire development lifecycle, from design, coding, deployment, and at runtime. The program develops and operates platforms for identifying, classifying, scanning, and reporting security vulnerabilities in all RiteAid assets across the company's cloud infrastructure and applications.

Security Engineering Director is hiring a principal level engineer to lead the development and operations of its vulnerability management program, finding and remediating vulnerabilities in both software artifacts during the software development lifecycles and all assets to RiteAid.

• Develop short- and long-term program and product strategies in partnership with product management and other engineering teams.
• Build the vulnerability management capabilities for both Application Vulnerability Management as well as Systems Vulnerability Management.
• Responsible for identifying, categorizing, reporting, and remediating vulnerabilities in all our environments whether it is on systems, networks, applications, web applications, or code.
• Responsible for driving the risk associated with the identified vulnerabilities down by providing a clear way of patching and fixing these vulnerabilities to other engineering teams.

Qualifications

• 7 years of experience in vulnerability management, including 3+ years’ experience in a high-availability 24/7 environment required.
• Hands-on experience of different vulnerability management programs.
• Strong knowledge and experience in managing both Web application vulnerability management lifecycle and Systems vulnerability management lifecycle.
• Proven track record of designing, coding, and delivering large-scale PaaS or IaaS systems, especially on public cloud substrates (AWS/GCP).
• Proficiency in object-oriented and multi-threaded programming to support code-reviews and guiding engineers in at least one of the following languages: Golang, Java, C++, Python.
• Strong knowledge in security fundamentals: authentication/authorization frameworks (e.g., SSO, SAML, Oauth), secure transport (e.g., SSL, TLS), identity management (e.g., certificates, PKI), vulnerability management.
• DevOps mindset and strong ownership over owned code (test, monitor, deploy, maintain).
• Ability to lead, motivate, and grow teams of developers in a challenging, dynamic, and global environment.

Requirements

• Bachelor’s Degree in Arts/Sciences (BA/BS) Computer Science / Engineering required.
• Master’s degree in Arts/Sciences (MA/MS) Computer Science/Engineering preferred.