Security Engineer II - Cloud & Vulnerability Management

• Own recurring vulnerability scanning, triage, prioritization, remediation tracking, exception follow-up, and closure validation across hybrid infrastructure.
• Operate and improve vulnerability-management tooling, including Rapid7 InsightVM or comparable platforms.
• Use Wiz and other asset or cloud-security data to add workload, exposure, ownership, and business context to vulnerability decisions.
• Maintain accurate visibility into servers, network devices, endpoints, cloud workloads, and other in-scope assets by reconciling scanner, endpoint, cloud, and inventory data.
• Prioritize findings using exploitability, exposure, asset criticality, business impact, compensating controls, and available threat intelligence—not CVSS alone.
• Partner with Engineering, SRE, IT, and Infrastructure teams to assign owners, agree on remediation plans, manage blockers, and verify that risk has been reduced.
• Track remediation SLAs, exceptions, recurring weaknesses, and coverage gaps; escalate material risk using clear evidence.
• Produce concise reporting that helps technical teams act and gives security leadership an accurate view of exposure and progress.
• Recommend practical improvements to patching, configuration hygiene, asset ownership, reporting, and remediation workflows.
• Lead and support security incidents as part of an on-call rotation.
• Maintain runbooks, evidence, scan records, and remediation documentation for operational continuity and audit readiness.
• Use AI-assisted tools to accelerate triage, analysis, reporting, and workflow improvement while protecting sensitive data, validating outputs, and remaining accountable for decisions.

Expected impact

You will improve asset and scanning coverage, make remediation priorities more actionable, strengthen SLA performance, improve closure validation, and help reduce recurring vulnerabilities through durable operating improvements.

What you will bring

Must-have qualifications

• Hands-on experience operating a recurring vulnerability management program or major workstream.
• Experience with vulnerability discovery, triage, risk-based prioritization, remediation coordination, and closure validation.
• Experience working with infrastructure, endpoint, network, or cloud asset owners to drive remediation.
• Practical experience with a platform such as Rapid7 InsightVM, Tenable, Qualys, or equivalent.
• Experience supporting security incidents as part of an on-call rotation.
• Demonstrable experience in vulnerability management in a hybrid environment (AWS preferred).
• Understanding of CVE/CVSS concepts, exploitability, asset criticality, network exposure, and compensating controls.
• Working knowledge of infrastructure and network security fundamentals.
• Ability to translate technical findings into clear priorities and actions.
• Demonstrated ownership, follow-through, and early escalation of blockers.
• Practical experience using AI-assisted tools in a professional workflow, with appropriate review, validation, and data-handling judgment.

• Experience with Rapid7 InsightVM.
• Experience using Wiz or another CSPM platform for cloud workload vulnerability context.
• Experience reconciling scanner data with CMDB, endpoint, cloud inventory, or ticketing systems.
• Familiarity with CIS Benchmarks, CISA Known Exploited Vulnerabilities, EPSS, and risk-exception workflows.
• Scripting, API, workflow-automation, or security-reporting experience.
• Ideal differentiators
• Demonstrated improvement in asset coverage, remediation SLA performance, backlog quality, or recurring-finding rates.
• Experience across cloud, on-premises, network, and endpoint assets.
• Experience creating repeatable, securely validated AI-assisted security workflows.

guidelines

Typically, 3–5 years of relevant security experience, including at least 2 years of direct vulnerability-management responsibility.

Equivalent practical experience is valued.

A relevant degree or certifications such as Security+, CySA+, or a cloud-security certification is helpful but not required.

Why work at Nasuni?

As part of our commitment to your well-being, we are pleased to offer comprehensive benefits packages to employees across the US.

packages generally include:

• Best in class employee onboarding and training
• "Take What You Need” paid time off policy
• Comprehensive health, dental and vision plans
• Company-paid life and disability insurance
• 401(k) and Roth IRA retirement plan
• Generous employee referral bonuses
• Flexible remote work policy

• Wide array of wellbeing offerings
• Pre-tax savings accounts with company contributions
• Great team culture and social activities
• Collaborative workspaces
• Free on-site fitness centers and stocked kitchens in select office locations
• Professional development resources

In accordance with U.S. pay transparency laws, Nasuni is committed to providing visibility into compensation for all U.S.-based roles.

Click HERE to view our compensation ranges by job grade.

Actual compensation will be based on a variety of factors, including a candidate’s experience, skills, education, and work location.

To all recruitment agencies: Nasuni does not accept agency resumes.

Please do not forward resumes to our job boards, Nasuni employees or any other company location.

Nasuni is not responsible for any fees related to unsolicited resumes.

Nasuni is an equal opportunity employer. The equal employment opportunity policy at Nasuni protects employees and job applicants from discrimination on the bases of race, religion, color, sex (including pregnancy, gender identity, and sexual orientation), parental status, national origin, age, disability, family medical history or genetic information, political affiliation, military service, or other non-merit based factors. These protections extend to all management practices and decisions, including recruitment and hiring practices, appraisal systems, promotions, and training and career development programs.

This privacy notice relates to information collected (whether online or offline) by Nasuni Corporation and our corporate affiliates (collectively, “Nasuni”) from or about you in your capacity as a Nasuni employee, independent contractor/service provider or as an applicant for an employment or contractor relationship with Nasuni.

This privacy notice relates to information collected (whether online or offline) by Nasuni Corporation and our corporate affiliates (collectively, “Nasuni”) from or about you in your capacity as a Nasuni employee, independent contractor/service provider or as an applicant for an employment or contractor relationship with Nasuni.