Senior Security Engineer, Vulnerability Management

Location: Livingston, NJ; New York, NY; Sunnyvale, CA; or Bellevue, WA. This is a full-time role based at one of the listed U.S. locations. Access to export-controlled information requires U.S. person status, eligibility without export authorization, or eligibility and reasonable likelihood of obtaining the required authorization.

Base salary: $139,000–$204,000 per year, plus discretionary bonus, equity awards, and benefits subject to eligibility.

Company

CoreWeave provides cloud infrastructure, tools, and teams for building and scaling AI applications.

What you will do

• Own vulnerability management technical projects end to end and contribute to architecture decisions.
• Build and maintain triage automation, integrations, decision logic, and production hardening.
• Implement workflows from vulnerability assessment and detection through ticket routing and remediation tracking.
• Investigate hardware-adjacent vulnerabilities involving GPU firmware, DPU firmware/BlueField, and BMC surfaces; support embargoed disclosures and zero-day response.
• Develop prioritization logic, severity models, exception workflows, technical metrics, and risk reporting.
• Perform root-cause analysis, improve workflow reliability and remediation speed, review code, document systems, and help onboard teammates.

Requirements

• 5+ years of relevant experience in vulnerability management, application security, platform security, or cloud security engineering.
• Experience building production security automation, including SOAR workflows, AI/ML systems, or detection pipelines.
• Working knowledge of CVSS, EPSS, CISA KEV, threat intelligence integration, and risk-based prioritization frameworks.
• Strong development skills in Python, Go, or similar languages for production-grade security systems.
• Hands-on experience with modern vulnerability management tools such as Wiz, Semgrep, Rapid7, Tenable, or equivalent.
• Track record of collaborating across teams to deliver technical projects.
• Understanding of how security decisions affect engineering velocity, customer trust, and business outcomes.

Nice to have

• Familiarity with GPU/DPU environments, firmware security, hardware vulnerabilities, or high-performance computing.
• Experience building AI/ML-powered security systems, including LLM integration, automated decision-making, and human-in-the-loop validation.
• Exposure to hardware vendor security work, embargoed disclosures, and pre-release collaboration.
• Experience with TINES, AWS Lambda, or GCP Cloud Functions.
• DevOps, DevSecOps, or SRE experience with AWS, GCP, or Azure and Infrastructure as Code using Terraform or CloudFormation.
• Working knowledge of Kubernetes security, including container scanning, admission controllers, supply chain security, and runtime protection.
• Experience in fast-growing startup or cloud-native environments.
• Experience managing vulnerabilities in a FedRAMP-certified or similar regulated environment.

Culture & Benefits

• Entrepreneurial, collaborative environment focused on independent thinking and innovative solutions.
• Medical, dental, and vision insurance fully paid by CoreWeave for eligible U.S.-based full-time employees.
• Life and disability insurance, flexible spending and health savings accounts, mental wellness benefits, and family-forming support.
• Tuition reimbursement, employee stock purchase program, paid parental leave, childcare support, flexible PTO, and 401(k) with employer match.
• Catered lunch at office and data center locations, casual work environment, and a culture focused on innovative disruption.