Senior Staff Security Engineer, Vulnerability Management

The role

You will architect and scale an automated vulnerability detection and remediation ecosystem across Compliance, Security and Engineering. You will own the technical roadmap for an AI-driven vulnerability scanning platform and build automated remediation pipelines with Software Engineering and DevOps.

What you will do

• Own the technical roadmap for an automated, AI-driven vulnerability scanning platform across cloud, containers, operating systems and applications
• Build context-engine models that correlate SAST, DAST, SCA and cloud posture findings to determine true runtime exploitability
• Implement AI-assisted triage workflows that reduce false positives and route validated issues to engineering teams
• Lead red teaming and purple teaming exercises to validate exploitable paths and strengthen runtime defenses
• Partner with Software Engineering and DevOps on automated remediation pipelines, including dependency updates and base-image patching
• Engineer security scanning guardrails into CI/CD pipelines and provide telemetry for continuous compliance and executive risk visibility
• Use generative AI tools to analyze findings, improve prioritization and speed up remediation

Required qualifications

• At least 8 years of experience in infrastructure, container platforms and product security, with security engineering, vulnerability management or software development experience
• Track record of writing production-grade automation scripts and building custom security tooling at scale
• Hands-on experience planning or executing offensive security exercises, red teaming, purple teaming or penetration testing
• Deep experience securing cloud infrastructure and containerized ecosystems on AWS, GCP or Azure, with Docker and Kubernetes
• Advanced proficiency in Python, Go or Rust
• Familiarity with adversarial frameworks, CVSS and EPSS scoring, and OWASP Top 10 attack vectors
• Experience integrating security scanners into CI/CD workflows and using AI or LLM APIs to analyze code or log data
• Ability to integrate generative AI tools into daily workflows

Nice to have

• Advanced security certifications such as OSCE, OSCP, GXPN or CISSP, or equivalent practical engineering experience

Benefits

• Flexible work environment
• Unlimited vacation
• 100% paid employee health benefit options, including medical, dental and vision
• 401(k) with employer funded match
• Corporate wellness programs with Headspace and Peloton
• Sabbatical leave for employees with 5+ years of service
• Competitive paid parental leave and fertility/family planning reimbursement
• Cell phone reimbursement
• Employee Resource Groups and ZocClubs
• Great Place to Work Certified

Before you apply

• Base salary depends on experience, qualifications and skills
• Hiring includes a review of candidates against market-aligned salary ranges

About the company

Zocdoc is a digital health marketplace that helps patients find and book in-network care online. The company is building infrastructure to power access to care wherever patients search.