Threat & Vulnerability Management Security Engineer II
AmTrust Financial · Cleveland, OH, US
About this role
## Overview The TVM Security Engineer II is a key member of the Threat & Vulnerability Management team, responsible for reducing enterprise technology risk through the identification, assessment, prioritization, remediation, and ongoing management of vulnerabilities across the organization. In this role, you will analyze and correlate vulnerability findings, apply risk-based decision making, and partner with application, infrastructure, cloud, DevOps, and risk teams to drive remediation through verified closure. You will also support vulnerability governance, exception management, metrics, reporting, and continuous program improvement to enhance overall security posture. ## Responsibilities ### Threat & Vulnerability Management - Own and continuously evolve the enterprise Vulnerability Management Program across the IT environment. - Manage the end-to-end vulnerability lifecycle: discovery, validation, risk prioritization, remediation tracking, exception management, verification, and reporting. - Analyze threat actors, campaigns, industry trends, and emerging cyber risks to inform vulnerability prioritization and exposure management. - Operate and optimize vulnerability assessment technologies to maintain comprehensive asset coverage, accurate findings, and actionable risk visibility. - Correlate and prioritize findings across vulnerability management platforms, attack surface management solutions, and threat intelligence sources. - Apply risk-based prioritization using CVSS, CISA Known Exploited Vulnerabilities (KEV), exploitability, asset criticality, exposure, and business impact. - Partner with asset management and technology teams to improve asset inventory accuracy, security coverage, ownership attribution, and enterprise risk visibility. - Design, develop, and maintain security automation capabilities to streamline vulnerability management and related security operations. - Build and enhance integrations, workflows, and tooling across security platforms to automate repetitive tasks and improve reporting. ### Remediation & Governance - Coordinate and drive remediation across infrastructure, application, cloud, network, and other technical teams to meet service-level objectives and risk severity. - Lead coordinated response for critical vulnerabilities, zero-day threats, and actively exploited CVEs (rapid assessment, prioritization, remediation, and risk communication). - Manage vulnerability exceptions, compensating controls, risk acceptance processes, and periodic exception reviews. - Develop and maintain vulnerability management policies, standards, procedures, runbooks, and reporting frameworks. - Develop executive and operational metrics (risk reduction, remediation performance, vulnerability trends, asset coverage, SLA adherence, exception exposure, MTTR). - Support audits, compliance assessments, and enterprise risk management through documentation, reporting, and evidence collection. - Monitor emerging vulnerabilities, exploitation trends, threat intelligence, and industry best practices to improve program effectiveness. ## Qualifications - Bachelor’s degree in Computer Science, Information Technology, Computer Engineering, Cybersecurity, or related field, **or** equivalent relevant professional experience. - 3+ years of experience managing enterprise vulnerability management programs across on-premises, cloud, and hybrid environments. - Hands-on experience with vulnerability management platforms (e.g., Tenable, Qualys,
Listing freshness
CronJobs last confirmed this listing 2h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.