Senior Exposure Management Engineer - Mid-Atlantic region (Remote)

Title: Senior Exposure Management Engineer - Mid-Atlantic region (Remote) Location: Remote

General Description
We are looking for a skilled Senior Exposure Management Engineer to support GuidePoint Security's Mid-Atlantic Exposure Management practice. The Senior Exposure Management Engineer will be required to demonstrate strong asset management, integration, and risk-based vulnerability management skills, lead by influence, and strong business/financial acumen to drive the use of progressive exposure management programs that will align the delivery of business objectives and priorities.
About the Mid-Atlantic Exposure Management Practice
The Mid-Atlantic Exposure Management Practice is responsible for helping clients see everything they own and fix what matters most. We build unified, real-time asset inventories and risk-based exposure programs — with the Axonius Asset Cloud at the center — that turn fragmented data from hundreds of security and IT tools into a single, trusted asset model and a prioritized, business-aware remediation backlog.
Our team of exposure management engineers, Axonius platform specialists, and automation developers focuses on cyber asset attack surface management (CAASM), risk-based vulnerability management (RBVM), and exposure prioritization. We partner with client security, IT, infrastructure, and cloud teams to eliminate blind spots, de-duplicate findings across tools, assign asset ownership, and drive measurable risk reduction.

Roles and Responsibilities:
Exposure Management Platform Operations

• Operate and maintain security platforms including vulnerability management, RBVM, CAASM, and CNAPP tools
• Monitor security findings and support prioritization and remediation workflows
• Assist in platform tuning, configuration optimization, and integration with client environments
• Support onboarding of new assets, applications, and cloud environments into security platforms

Exposure Management Operations

• Review exposure findings and assist with prioritization and remediation tracking
• Help manage remediation workflows with client engineering teams
• Generate operational dashboards and reporting for security leadership
• Assist in maintaining asset inventory coverage and scanning accuracy

Traditional Vulnerability Management

• Deploy, configure, and maintain vulnerability scanners (e.g., Tenable Nessus/Tenable.sc, Qualys VMDR, Rapid7 InsightVM) across on-premises, cloud, and hybrid environments.
• Design scan sites, asset groups, scan templates, and schedules that deliver complete coverage while minimizing operational impact on production systems.
• Configure and manage authenticated (credentialed) scanning, scan engines, and agent deployments; troubleshoot credential failures and coverage gaps.
• Execute and validate network, host, and web application vulnerability scans; verify findings and reduce false positives.
• Manage the full vulnerability lifecycle — discovery, validation, assignment, remediation, re-scan verification, and closure.
• Coordinate patch and configuration remediation with IT and system owners, and track risk acceptances, exceptions, and compensating controls.
• Perform configuration and compliance scanning against benchmarks such as CIS and DISA STIG.
• Maintain vulnerability management policies, SLAs, and standard operating procedures aligned to frameworks such as NIST, PCI DSS, and CIS Controls.
• Produce recurring vulnerability metrics and reports, including open/aging vulnerabilities, mean time to remediate, and scan coverage.

Risk-Based Vulnerability Management Configuration

• Configure risk-based vulnerability management (RBVM) so that vulnerabilities are prioritized by real-world risk — business impact, exposure, and exploitability — rather than by CVSS score alone.
• Ingest and consolidate vulnerability findings from multiple scanners (e.g., Tenable, Qualys, Rapid7) into RBVM platforms such as Axonius, Nucleus, Brinqa, Armor Code, Cogent, Zafran and configure de-duplication so a single vulnerability reported by different tools is represented once.
• Build and maintain asset criticality ratings and business-context tags so prioritization reflects the importance of each asset to the business.
• Configure enrichment of findings with threat intelligence and exploitability signals (e.g., known-exploited, active-in-the-wild) to surface the vulnerabilities attackers are most likely to use.
• Design saved queries and dynamic asset/vulnerability views that isolate high-risk, exposed, mission-critical findings and filter out low-risk noise and items already within SLA.
• Configure risk scoring, severity mapping, and prioritization logic that combine CVSS, exposure (internet-facing vs. isolated), exploit status, asset criticality, and existing mitigating controls.
• Build automation workflows and dashboards to automate remediation workflows — create and route tickets to the correct owner in ServiceNow/Jira, notify teams, and track SLA and patch-window adherence.
• Configure escalation (“fire alarm”) logic and SLA-based rules for critical and zero-day vulnerabilities that require faster-than-standard remediation.
• Build dashboards and reporting that show remediation progress, SLA compliance, risk reduction over time, and coverage — tailored for both operational teams and security leadership.
• Continuously tune prioritization models and reduce alert fatigue so client teams focus effort on the findings that actually reduce risk.

CNAPP & Cloud Security Support

• Assist with the operation and optimization of CNAPP platforms (e.g., Wiz, Prisma Cloud, Orca)
• Support cloud posture monitoring and exposure analysis
• Assist with investigation of cloud misconfigurations, identity exposures, and attack paths
• Work with senior engineers to onboard new cloud environments

Automation & Integrations

• Develop scripts and automation to improve security workflows
• Build integrations between security tools and ticketing systems
• Automate reporting, vulnerability triage, and remediation tracking
• Use APIs and automation frameworks to reduce manual operational effort
• Use the Axonius Query Language, REST API, and Enforcement Center to automate asset queries, enrichment, ticketing, and remediation actions.

Client Engagement

• Participate in regular operational cadence meetings with clients
• Provide updates on platform findings and remediation progress
• Assist senior engineers in troubleshooting security platform issues
• Contribute to documentation and operational playbooks

Required Experience:

• 7+ years of experience in cybersecurity engineering
• Exposure management or risk-based vulnerability management experience
• Experience building and maintaining unified asset inventories from disparate security and IT data sources.
• Experience configuring asset criticality, ownership, and business context to drive risk-based prioritization.
• Familiarity with vulnerability management, exposure management, or CNAPP platforms such as Tenable, Qualys, Rapid7, Wiz, Axonius, or similar tools
• Hands-on experience running enterprise vulnerability scanning programs, including authenticated scanning, scan scheduling, false-positive validation, and remediation tracking.
• Scripting experience (Python, PowerShell, or similar)
• Experience working with APIs or automating workflows
• Understanding of security fundamentals: vulnerabilities, misconfigurations, identity and access control, security monitoring
• Strong communication skills and ability to work with engineering teams
• Embraces emerging technologies, including AI tools, to work smarter, solve problems, and drive better business outcomes.

Preferred Experience:

• Experience with CNAPP platforms such as: Wiz, Prisma Cloud, Orca, Lacework
• Experience with cloud platforms: AWS, Azure, GCP
• Familiarity with container security and Kubernetes
• Experience integrating security tools with ticketing platforms (Jira, ServiceNow)
• Direct engineering experience with RBVM integrations, correlation tuning, and the Enforcement Center.
• Experience with cyber asset management (CAASM), asset discovery, and network enumeration tooling.
• Experience in Linux environments and API-based data retrieval from security/infrastructure tools (EDR, IdP, NGFW, cloud providers).
• Experience using AI-assisted tools (LLMs, copilots, or agent frameworks) to accelerate scripting, analysis, and security operations workflows

Travel Requirements:

• Up to 10% travel

Physical Requirements:

• Sedentary work
• Substantial movement of the wrists, hands, and/or fingers for a minimum of 8 hours a day
• Required to have close visual acuity to view computer terminal and/or extensive reading for a minimum of 8 hours a day

Note: Applicants must be authorized to work for any employer in the U.S. We are unable to sponsor or take over sponsorship of an employment visa for this role.