Lead Security Engineer - Vulnerability Management

Job Summary

This role is designed for a lead cybersecurity engineer with approximately 8+ years of experience in vulnerability management, exposure management, offensive security, application security, and security automation. The position serves as a technical lead and subject-matter expert for the vulnerability management function, helping shape the roadmap and owning delivery of maturity initiatives from approach through measurable outcomes. The Lead Security Engineer will partner with cybersecurity, infrastructure, application, and platform teams to evolve vulnerability management into a proactive, risk-based program. The role brings depth in areas such as risk-based prioritization, automation and AI-assisted triage, application security, vulnerability disclosure, and offensive security, and mentors engineers to scale proven practices.

Responsibilities

• Serve as technical lead and subject-matter expert for vulnerability management, advising on program direction, tooling, and prioritization across Staples environments.
• Own end-to-end delivery of vulnerability management maturity projects, from defining the approach and success measures through implementation, adoption, and reporting.
• Design and build automation and AI-assisted workflows for triage, enrichment, ticketing, and reporting that reduce manual effort and improve time to remediation.
• Build and mature offensive security capabilities, including internal penetration testing, segmentation testing, purple-team exercises, and vulnerability disclosure and bug bounty programs.
• Evaluate and onboard new security capabilities, running proofs of concept and recommending adopt, extend, or retire decisions.
• Define runbooks, quality standards, and handoff practices for operational work, and coach engineers as proven processes are scaled across teams.
• Support PCI DSS, SOC 2, customer audit requests, and other compliance activities by providing accurate vulnerability evidence and remediation status.
• Report program health to senior leaders through dashboards and metrics that tie vulnerability data to business risk.
• Technologies: Qualys, NoName API Security, Seemplicity UVM/UEM, FIM, ServiceNow, CheckmarxOne, Orca Security, GitHub, EASM, CSPM, Rapid7 DAST; vulnerability management, exposure management, DAST, API security, SAST, SCA, CSPM, IoT/OT security, threat intelligence, penetration testing, purple teaming; Python, PowerShell, Bash, REST APIs, Git, Power BI, LLM and AI-agent frameworks, ServiceNow workflows.

Requirements

Basic Qualifications

• Minimum of 8+ years of hands-on cybersecurity experience, including significant depth in vulnerability management, offensive security or application security testing, and security automation, with experience leading projects or mentoring others.
• Expert-level experience with vulnerability management platforms, scanning, and the full lifecycle from detection and prioritization to remediation and verification.
• Strong understanding of risk-based prioritization models and signals such as CVSS, EPSS, CISA KEV, and exploit maturity.
• Hands-on experience with offensive security techniques, such as penetration testing, web and API testing, or red/purple teaming, and with DAST or application security tooling.
• Proficiency in Python or a comparable language for automation, API integrations, and data analysis, plus familiarity with applying LLMs to security workflows.
• Proven ability to lead projects, document processes clearly, and mentor engineers.

Preferred Qualifications

• Relevant certifications such as OSCP, GPEN, GWAPT, CISSP, or equivalent offensive and security certifications.
• Experience with ServiceNow, Seemplicity, or similar remediation workflow and exposure-management platforms, with defined SLAs and ownership tracking.
• Experience building or running vulnerability disclosure or bug bounty programs, IoT/OT security assessments, or threat-intelligence pipelines is preferred.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.