Vulnerability Manager

About the role

BeyondTrust is seeking a Vulnerability Manager to own and operate its product vulnerability management program end‑to‑end. This fully remote position focuses on FedRAMP 20x compliance and establishing vulnerability processes for new SaaS products.

Key responsibilities

• Design and run the full vulnerability management lifecycle: intake, triage, risk assessment, assignment, SLA tracking, exception handling, and closure verification.
• Own FedRAMP 20x vulnerability monitoring, evidence collection, KPI reporting, and POA&M lifecycle.
• Implement vulnerability management for new products, defining scan coverage, onboarding, SLAs, and reporting from launch.
• Assess and rank risk using exploitability, exposure, asset criticality and compensating controls, and communicate rankings to engineers and auditors.
• Drive remediation with engineering teams, manage escalations, and record time‑bound risk acceptances.
• Automate manual effort with scripting, workflow tools, and AI‑assisted analysis for triage, deduplication, enrichment and evidence gathering.
• Define integration requirements for scanners, ticketing, asset inventory and dashboards, and validate deliveries with Security Engineering.
• Track program metrics (SLA attainment, MTTR, aging, backlog, coverage) and report regularly to leadership.
• Lead rapid response for actively exploited or zero‑day findings, coordinating mitigation and stakeholder communication.

Required profile

• 5+ years of hands‑on vulnerability management or product security experience with full ownership of a process.
• Proven experience designing and operating vulnerability management in regulated or audited environments.
• Working knowledge of FedRAMP, NIST SP 800‑53, continuous monitoring and POA&M.
• Ability to drive remediation across engineering teams without direct authority.
• Strong written and verbal communication with engineers, executives, auditors and customers.

Required skills

• Python scripting (or equivalent) for automation.
• Experience with enterprise vulnerability and exposure management platforms.
• Familiarity with cloud security posture tools, container scanning and software composition analysis.
• Understanding of CVSS, CISA KEV, EPSS and risk‑based prioritization.
• Knowledge of AWS cloud services, containers, Kubernetes, CI/CD pipelines, web applications and APIs.