Vulnerability Management Engineer

🕒 July 21

🇵🇭 Philippines – Remote

⏰ Full Time

🟡 Mid-level

🟠 Senior

👷🏻‍♀️ Engineer

👻 Ghost score 57%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Workstreet

WebsiteLinkedInAll Job Openings

11 - 50 employees

Founded 2023

🔒 Cybersecurity

📋 Compliance

🤝 B2B

Cybersecurity • Compliance • B2B

Workstreet is a managed security and compliance services provider that helps businesses automate and modernize their security programs. With expertise in compliance frameworks including SOC 2, ISO 27001, HIPAA, and GDPR, Workstreet supports companies in achieving their security and compliance outcomes efficiently. Their services include acting as a virtual Chief Information Security Officer (vCISO), full-scale penetration testing, and vendor risk management, aiming to streamline security processes while allowing businesses to focus on growth.

📋 Description

• Serve as primary security advisor for an assigned portfolio of fast-growth startups • Triage Dependabot alerts, code scanning results, and secret scanning alerts across client repositories • Determine whether vulnerable packages or code paths are reachable and exploitable • Dismiss false positives with documented rationale and rank findings using CVSS, EPSS, CISA KEV, and client context • Review, test, and merge Dependabot pull requests • Open pull requests for upgrades involving transitive dependencies, major version bumps, and breaking changes • Apply code and configuration fixes directly and provide guidance for design changes • Work with client engineers through code review and release processes toward a sub-30-day remediation target • Configure and tune Dependabot, code scanning, and secret scanning across client GitHub organizations • Maintain scanning of container images, CI/CD pipelines, and Terraform using tools such as Wiz • Connect findings to Vanta so coverage gaps are visible • Fix vulnerabilities in base images, GitHub Actions workflows, CI/CD configuration, and Terraform-defined infrastructure • Deploy patches where required to AWS, Azure, and GCP systems • Document, verify, and track temporary vulnerability exceptions and long-term risk acceptances • Map remediation data to audit evidence for SOC 2, ISO 27001, HIPAA, CMMC, and NIST audits • Deliver project milestones, handle technical escalations, and produce status reports and executive summaries • Collaborate with client IT, DevOps, security, engineering, and cross-functional teams

🎯 Requirements

• Hands-on experience triaging and remediating vulnerabilities in web applications and dependencies • Experience with GitHub Dependabot and GitHub Advanced Security, or comparable SCA and SAST tools • Ability to read and modify code in JavaScript, TypeScript, Python, Java, or Go • Understanding of package managers, lockfiles, semantic versioning, and transitive dependencies • Ability to open pull requests, run tests, and resolve merge conflicts • Experience using CVSS, EPSS, CISA KEV, and reachability analysis for risk prioritization • Knowledge of common web vulnerability classes, including injection, cross-site scripting, SSRF, and broken access control • Experience with containers, CI/CD pipelines such as GitHub Actions, and Terraform • Ability to map monitoring and remediation records to SOC 2, ISO 27001, HIPAA, and CMMC audit evidence • Clear technical writing and ability to manage deliverables across multiple client accounts • Ability to build trust with US-based founders, engineering leaders, and executives • Track record managing dependency upgrades, change management, and remediation sequencing alongside distributed engineering, DevOps, and IT teams • Active credentials such as CompTIA Security+, CEH, GIAC GEVA, GIAC GWEB, AWS Certified Security - Specialty, or Microsoft SC-200 • Direct experience with AWS, GCP, and Azure workloads • Working knowledge of CVE lifecycle, NVD, GitHub Advisory Database, OSV, and CISA KEV • Familiarity with Tenable/Nessus, Qualys, or Rapid7 InsightVM • Excellent written and verbal English communication skills • Reliable high-speed internet connection and professional home office environment • Availability for a standard schedule of 8:00 AM–5:00 PM US Eastern Time • Willingness and ability to travel locally for occasional onsite meetings, team gatherings, or business activities • Mandatory practical web application and source code vulnerability assessment experience • Participation in live video interviews with camera on and identity verification • Successful identity verification and background screening, where permitted by law

🏖️ Benefits

• Clear path with mentorship and training opportunities • Comprehensive onboarding on security and compliance frameworks • Competitive base salary with regular performance reviews linked to merit-based appraisals and bonus opportunities • Significant room for career advancement • Remote-first flexibility to work from anywhere while collaborating with a global team

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume