Vulnerability Management Engineer

About Workstreet

At Workstreet, we are on an exciting journey to help businesses scale securely by designing and implementing cutting-edge security and compliance programs. As a fast-growing startup, we specialize in GRC (governance, risk, and compliance) services that support frameworks across SOC 2, ISO 27001, GDPR, CMMC, NIST 800-171, NIST 800-53, and FedRAMP.

Get to know the Vulnerability Management Team

Our Vulnerability Management team identifies, prioritizes, and fixes vulnerabilities hands-on across client environments, including direct patch deployment into AWS, Azure, and GCP. Ownership and follow-through define how we operate.

The Opportunity

We are seeking a consultative and hands-on Vulnerability Management (VM) Engineer to join our Delivery team. You will serve as the primary security advisor for an assigned portfolio of fast-growth startups, combining scanning infrastructure management with high-touch client advisory.

What You'll Do

• Triage and prioritize code vulnerabilities across Dependabot, code scanning, and secret scanning alerts, using CVSS, EPSS, CISA KEV, and asset context.
• Own remediation pull requests, including upgrades Dependabot cannot handle, and give engineers clear written guidance on fixes that need design changes.
• Configure and maintain scanning coverage across client GitHub organizations, container images, CI/CD pipelines, and Terraform, using tools such as Wiz and connecting findings to Vanta.
• Remediate pipeline, container, and infrastructure findings by changing code rather than the console.
• Manage exceptions and map remediation records to audit evidence for SOC 2, ISO 27001, HIPAA, CMMC, and NIST audits.
• Act as the primary point of contact and trusted security advisor for an assigned portfolio of startups, delivering milestones, escalations, and executive summaries.

Who You Are

• Application vulnerability engineer with hands-on triage and remediation experience in web applications and dependencies, using GitHub Dependabot and GitHub Advanced Security or comparable SCA and SAST tools.
• Comfortable reading and modifying code in at least one common web language such as JavaScript, TypeScript, Python, Java, or Go.
• Risk prioritizer who uses CVSS, EPSS, CISA KEV, and reachability analysis to rank fixes.
• Precision threat analyst who validates scanner output and understands injection, XSS, SSRF, and broken access control.
• Pipeline and infrastructure security practitioner experienced with containers, CI/CD pipelines, and Terraform.
• GRC-aware engineer who matches monitoring and remediation records to audit evidence requirements.
• Technical consultant and stakeholder diplomat who communicates technical risk in business terms.

What Will Help You Succeed

• Patch and dependency management at scale, ideally in an MSP/MSSP or consulting environment.
• Professional certifications such as CompTIA Security+, CEH, GIAC, AWS Certified Security - Specialty, or Microsoft SC-200.
• Cloud-native security experience on AWS, GCP, and Azure.
• Vulnerability intelligence knowledge of the CVE lifecycle, NVD, GitHub Advisory Database, OSV, and CISA KEV.
• Network and host scanner experience with Tenable/Nessus, Qualys, or Rapid7 InsightVM.

What We Offer

• Career development with mentorship and training opportunities.
• Technical training on security and compliance frameworks.
• Competitive base salary with performance reviews and bonus opportunities.
• Growth opportunity in an early-stage company.
• Remote-first culture with flexibility to work from anywhere while collaborating with a global team.

What You'll Need to Thrive

• Excellent written and verbal English communication skills.
• A reliable, high-speed internet connection and a professional home office environment.
• Commitment to a standard schedule of 8:00 AM to 5:00 PM US Eastern Time, with occasional flexibility.
• Willingness to travel locally for occasional onsite meetings.

Important Note for Applicants

Hands-on web application and source code vulnerability assessment experience is a mandatory requirement for this position. This is not a general infrastructure vulnerability scanning role.

Hiring and Selection Process

• Candidates must participate in live video interviews with the camera on and be prepared to verify identity.
• Employment is contingent upon successful identity verification and background screening, where permitted by law.
• Selected candidates will participate in structured interviews with hiring managers and cross-functional stakeholders.
• Candidates will receive prompt updates throughout the interview process.

Equal Opportunity

Workstreet is an equal opportunity employer and is committed to providing employment opportunities to all individuals regardless of race, color, ethnicity, religion, sex, gender identity, sexual orientation, national origin, disability, age, marital status, veteran status, pregnancy, or any other basis prohibited by applicable law.