Vulnerability & Attack Surface Management Analyst II

The role

You will build and run the vulnerability and attack surface management programs. You will manage the vulnerability lifecycle, build asset inventories, and drive remediation through engineering teams.

What you will do

• Run the vulnerability lifecycle including discovery, validation, prioritization, remediation tracking, verification, and reporting.
• Prioritize findings using a risk model weighing internet exposure, exploitability, asset criticality, and data sensitivity.
• Build a reliable asset inventory by combining cloud, endpoint, and SaaS inventory.
• Run external discovery on a regular schedule.
• Drive remediation by working with Engineering, IT, and Platform teams.
• Automate repetitive work and connect scanner and CNAPP APIs to ticketing and reporting.
• Own web application security including dynamic scans and WAF controls.
• Set up security checks for the new publishing platform.
• Manage vulnerability disclosure and bug bounty intake.
• Track and report metrics like mean time to remediate and SLA coverage.

Required qualifications

• 3 to 6 years in security, with significant hands-on experience in vulnerability management, attack surface management, or cloud security posture management.
• Hands-on experience running and tuning a vulnerability scanning or CNAPP platform.
• Experience prioritizing a large set of findings with a risk-based model.
• Working knowledge of CVSS, EPSS, and the CISA KEV catalog.
• Cloud security fundamentals in at least one major provider.
• Experience with container and image vulnerabilities and dependency (SCA) findings in code repositories.
• Comfort starting with an incomplete inventory.
• Experience working directly with engineering teams to get fixes shipped.
• Scripting skills (Python, PowerShell, or similar) sufficient to query APIs and automate reporting.
• Regular, hands-on use of AI tools (Claude, ChatGPT, GitHub Copilot, or similar) in security work.

Nice to have

• Experience with Wiz, Orca, Prisma Cloud, Defender for Cloud, or Lacework
• Experience with CrowdStrike Falcon Exposure Management or Spotlight
• Experience with Tenable, Qualys, or Rapid7
• Experience with external ASM tools and recon methods
• Experience with CAASM and inventory platforms such as Axonius or runZero
• Experience with SaaS discovery tools
• Experience with DAST and edge/WAF platforms (Invicti, Burp Suite, Cloudflare, Akamai)
• Experience with vulnerability disclosure or bug bounty programs (HackerOne, Bugcrowd)
• Experience with hardened or minimal base images (Chainguard, distroless, or an in-house golden image program)
• Experience with Kubernetes and container security at scale (GKE and EKS)

Benefits

• Competitive compensation
• Medical, Dental & Vision
• Flexible Spending / Health Savings Accounts
• Generous PTO and hybrid-work flexibility
• 401(k) with Company Match
• Life Insurance, Pet Insurance, and more

About the company

OpenLoop provides telehealth support solutions designed to streamline and simplify go-to-market care delivery for companies offering virtual support to patients in all 50 states.