Advanced Security Engineer (Exposure Management)

Location: Illinois, United States of America; hybrid/remote workplace

Salary: $104,000–$156,000 base salary, plus annual performance bonus and long-term incentives

Company

hirify.global develops software and operates a technology estate requiring vulnerability, exposure, cloud, container, and API security management.

What you will do

• Operate and optimize exposure and external attack-surface discovery for internet-facing, unmanaged, shadow, and newly introduced assets.
• Correlate vulnerabilities, misconfigurations, asset criticality, exploitability, internet exposure, compensating controls, and threat intelligence to produce risk-ranked exposure backlogs.
• Maintain risk visibility for live containers and APIs by connecting build and deployment findings with production runtime context.
• Integrate threat intelligence, including active exploitation and emerging-vulnerability signals, into exposure scoring and prioritization.
• Build dashboards, reporting, and data pipelines covering residual risk, ownership, exposure aging, discovery coverage, and reduction rates.
• Coordinate targeted exposure-reduction campaigns and follow-through with application- and service-owning teams while routing risk acceptance and specialist reviews to accountable functions.

Requirements

• 2–6 years of hands-on experience in vulnerability management, exposure management, attack surface management, cloud security, or a related security engineering discipline.
• Hands-on experience with vulnerability scanning, exposure management, or attack surface management platforms, including analysis of vulnerabilities, misconfigurations, unmanaged assets, and security posture findings.
• Experience prioritizing exposures using exploitability, asset criticality, internet exposure, threat intelligence, compensating controls, and business context rather than severity scores alone.
• Working knowledge of operating systems, networks, containers, APIs, and at least one major cloud platform.
• Familiarity with CVSS, CISA KEV, EPSS, NIST, MITRE ATT&CK, and CIS benchmarks.
• Proficiency in at least one scripting or automation language, such as Python, Bash, or PowerShell, for integrating security data, automating analysis, or improving workflows.
• Ability to investigate complex exposure data, identify systemic risk patterns, and communicate prioritized findings and recommended actions to technical and non-technical stakeholders.

Nice to have

• Bachelor’s degree in Computer Science, Cybersecurity, Information Security, or a related field, or equivalent practical experience.
• Experience assessing exposure across multi-cloud or cloud-native environments and with enterprise vulnerability, exposure, or attack-surface management platforms.
• Familiarity with AI-enabled SecOps, including ML-based risk prioritization or AI-assisted workflows.
• Basic knowledge of AWS, Azure, or GCP.
• Experience developing dashboards, metrics, or data pipelines.
• Experience supporting SOC 2, ISO 27001, or FedRAMP compliance and audit requirements from a technical control perspective.
• Relevant certifications such as CC, SEC+, CySA+, or equivalent.

Culture & Benefits

• Hybrid/remote work arrangement.
• Competitive base salary with an annual performance bonus and long-term incentives.
• Compensation decisions consider experience, skills, qualifications, and internal pay equity.