Infrastructure Security Vulnerability Engineer

Avaya

3d•$127,100 - $133,400

About The Position

Avaya is hiring two Infrastructure Security Vulnerability Engineers to identify, prioritize, track, and remediate vulnerabilities across infrastructure and applications in a cloud-based FedRAMP Moderate-compliant environment supporting U.S. federal government requirements. The role focuses on accelerating remediation in alignment with applicable CISA Binding Operational Directive 26-04 requirements, using threat intelligence, exposure data, and cloud-based AI tools to help technical teams address security risks. The engineer manages vulnerability remediation from identification through closure. Responsibilities include analyzing assessment findings, evaluating risk and exposure, coordinating remediation plans, and tracking progress in established systems of record. The role collaborates with application managers and owners, infrastructure teams, vendor managers, and risk partners to prioritize vulnerabilities and meet required timelines. It also supports vulnerability analysis, reporting, and continuous improvement in a regulated cloud environment.

Requirements

3–5+ years of experience in vulnerability management, vulnerability remediation, patch management, or a closely related infrastructure security role.
Hands-on experience with vulnerability assessment and management tools, including Tenable Security Center, Nessus, and Qualys.
Working knowledge of Windows Server 2019 and later, including vulnerability remediation, security patching, and system configuration.
Experience supporting Linux environments, particularly RHEL 9.x and later, including security updates, patching, and vulnerability remediation.
Understanding of CVE and CVSS analysis, vulnerability prioritization, exploitability, threat intelligence, asset criticality, and exposure-based remediation.
Demonstrated experience coordinating vulnerability remediation and patch management, tracking findings through closure, and working with technical teams to resolve security issues.
Familiarity with change management processes and coordinating remediation while supporting operational stability and established controls.
Experience using ServiceNow ticketing or similar systems to track vulnerabilities, document remediation, manage escalations, and maintain accurate records.
Strong Microsoft Excel and reporting skills, including analyzing vulnerability data, tracking metrics, identifying trends, and communicating risk status.
Strong written and verbal communication, collaboration, analytical, organizational, and troubleshooting skills; ability to manage multiple priorities in a deadline-driven environment.
Ability to work within a regulated cloud environment and follow security, compliance, documentation, and risk management processes.
Must be a U.S. citizen.
Education and experience: Bachelor’s degree or equivalent experience with 5–6 years of experience, or Master’s degree or equivalent experience with 4 years of experience.
Applicants must be currently authorized to work in the United States without visa sponsorship now or in the future.

Nice To Haves

Familiarity with FedRAMP, NIST SP 800-53, DISA STIGs, and federal cybersecurity compliance requirements.
Experience using CISA Known Exploited Vulnerabilities information and other threat intelligence sources to prioritize remediation based on active exploitation and emerging threats.
Experience supporting U.S. federal government, DoD, or other regulated enterprise environments.
Experience with PowerShell, Bash, or Python for automating vulnerability analysis, reporting, patch management, or remediation workflows.
Familiarity with ManageEngine Endpoint Central or similar endpoint management and patch deployment platforms.
Experience supporting VMware environments and Active Directory infrastructure.
Experience identifying and coordinating remediation of application vulnerabilities, including web application security findings.
Familiarity with cloud security technologies and AI-assisted tools for vulnerability analysis, security operations, and risk reduction.
Track record of improving remediation timelines, reporting processes, and technology risk through coordination and automation.
Relevant cybersecurity, vulnerability management, infrastructure security, or cloud security certifications; examples include CompTIA Security+, CompTIA CySA+, and CISSP.

Responsibilities

Lead and coordinate vulnerability remediation across infrastructure and applications, tracking, prioritizing, and resolving findings in accordance with security requirements and remediation timelines.
Assess vulnerability risk using CVE and CVSS data, exploitability, threat intelligence, asset criticality, attack paths, exposure information, and other risk indicators.
Support remediation aligned with applicable CISA BOD 26-04 requirements and other federal cybersecurity directives, including monitoring required deadlines.
Support vulnerability assessment and remediation for Windows Server 2019 and later, Linux/RHEL 9.x and later, and application environments; work with technical teams on patching, configuration changes, and other corrective actions.
Use Tenable Security Center, Nessus, and Qualys to review findings, validate remediation, identify outstanding exposures, and support vulnerability management operations.
Collaborate with application owners and managers, infrastructure teams, vendor managers, and risk partners to communicate findings, clarify requirements, resolve questions, and drive issues to closure.
Maintain accurate vulnerability records in ServiceNow or other designated systems of record, documenting actions and updating remediation status and outstanding items.
Coordinate patching and remediation with application and infrastructure teams under established change management processes.
Support vulnerability exception management, risk-based remediation decisions, incident-driven response, and escalation of overdue or unresolved vulnerabilities.
Use cloud-based AI tools where appropriate to support vulnerability identification, analysis, prioritization, and remediation workflows, applying security judgment and review processes.
Develop and maintain vulnerability management metrics and reports, including remediation progress, aging and overdue findings, risk trends, and remediation effectiveness.
Improve vulnerability management procedures, workflows, reporting accuracy, and operational efficiency; maintain documentation of findings, remediation, exceptions, and processes.