Senior Engineer, Exposure & Vulnerability Management

Location: Remote position based in the United States; regular on-site visits are required for routine work and departmental events.

Annual base salary: $134,200–$180,600, plus annual bonus, equity compensation, and benefits.

Company

hirify.global is a clinical-stage TechBio company developing investigational medicines through the AI-native hirify.global OS, which integrates biology, chemistry, clinical development, proprietary multimodal data, and AI models.

What you will do

• Design and deploy multi-agent systems that manage exposures from discovery through verified closure, including dependency mapping, patch or IaC generation, validation, approval gates, audit trails, and rollback.
• Build risk-based prioritization using reachability, attack paths, business criticality, CVSS, EPSS, CISA KEV, and live exploit intelligence.
• Automate verification to distinguish theoretical vulnerabilities from actively exploitable conditions and reduce alert noise.
• Drive the CTEM strategy across products, platforms, cloud and on-premise infrastructure, and corporate applications.
• Architect cloud-native discovery, asset inventory, and remediation workflows integrated with ticketing, CI/CD, configuration management, and security tooling.
• Partner with Engineering and IT on secure-by-default practices, risk-aligned remediation timelines, security metrics, and SOC2-related controls.

Requirements

• Bachelor’s or Master’s degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
• 7+ years of experience in vulnerability management, exposure management, or related information security domains, including leading large-scale programs from strategy through execution in cloud-first and hybrid environments.
• Deep understanding of security principles and experience turning vulnerability data into prioritized, owned, and verified remediation.
• Hands-on experience building or deploying AI/LLM-based agents or multi-agent systems for security or engineering workflows, including orchestration, tool use, and evaluation.
• Working knowledge of approval workflows, audit logging, rollback controls, and risks associated with agent-driven changes.
• Proficiency in one or more programming languages such as Python, Go, or Java, with strong scripting skills for automation and integration.
• Expertise with vulnerability and exposure management platforms such as Tenable, Qualys, Rapid7, or equivalent, plus CTEM, attack surface management, and attack-path analysis tooling.
• Experience with AWS, Azure, or GCP; container and Kubernetes security; Terraform or CloudFormation; CI/CD; SCA/SAST; SBOMs; dependency mapping; and software supply chain security.
• Knowledge of UNIX/Linux, macOS, Windows, networking, database management systems, risk management, and compliance requirements such as SOC2 or GxP.

Nice to have

• Relevant security certifications such as CISSP, OSCP, or GWAPT.

Culture & Benefits

• Remote work is available within the United States, with regular on-site visits for routine work and departmental events.
• Compensation includes annual bonus eligibility, equity compensation, and a comprehensive benefits package.
• Work takes place in a cross-functional Information Security organization supporting secure technology services and business objectives.
• Values emphasize integrity, direct engagement, active learning, urgency, ownership, accountability, and collaboration.