Staff Vulnerability Management Engineer

The role

You will lead the discovery and fixing of vulnerabilities in web applications, APIs and endpoints. You will build automation across the full vulnerability lifecycle and work with engineering and IT teams to close findings.

What you will do

• Build and run automation across the vulnerability lifecycle: asset discovery, authenticated scanning, triage, routing to owners and verifying closure
• Diagnose why authenticated web application and API scans fail, implement fixes and bring remaining services into active coverage
• Establish and run endpoint vulnerability management as a routine program with IT
• Architect and implement scanning and assessment workflows for new application, API and endpoint systems
• Drive remediation to closure with engineering and IT teams and identify the next automation opportunities

Required qualifications

• Foundational understanding of AI/ML technologies and experience leveraging, securing or positioning AI-driven solutions
• Extensive professional experience in software or security engineering, with substantial depth in security engineering
• Hands-on experience developing and running security automation in production using Python, REST APIs, OAuth and token refresh, rate limiting, and data parsing and de-duplication
• Ability to explain vulnerability exploit mechanics from attacker input to operational impact, and the defensive controls that stop them
• In-depth web application and API security expertise, including authentication flows, CWE-level vulnerability analysis, and the vulnerability lifecycle across detection, prioritization, mitigation and

Nice to have

• Experience leveraging AI/ML technologies and orchestration platforms for triage, automated remediation routing and predictive exposure analysis
• Hands-on experience deploying or administering enterprise security tools such as Tenable, Qualys, CrowdStrike, Wiz or Burp Suite, and working knowledge of AWS, Azure or GCP
• Track record of building internal security tooling adopted by engineering teams, using risk-based signals such as CISA KEV, EPSS and asset criticality

Benefits

• Various health plans
• Time off plans for vacation and sick time
• Parental leave options
• Retirement options
• Education reimbursement
• In-office perks

Before you apply

• Zscaler complies with applicable pay transparency rules
• Accommodations are available in the recruiting process for candidates who need them

About the company

Zscaler provides a cloud security platform, the Zero Trust Exchange, that connects users, devices and applications in any location. The posting describes it as the world's largest in-line cloud security platform.