Infrastructure Security Vulnerability Engineer

Avaya

3d•$127,100 - $133,400

About The Position

Avaya is hiring two Infrastructure Security Vulnerability Engineers to identify, prioritize, track, and remediate vulnerabilities across infrastructure and applications in a cloud-based FedRAMP Moderate-compliant environment supporting US federal government requirements. The role focuses on accelerating remediation in alignment with applicable CISA Binding Operational Directive 26-04 requirements, using threat intelligence, exposure data, and cloud-based AI tools. The engineer manages vulnerability remediation from identification through closure. This includes analyzing assessment findings, evaluating risk and exposure, coordinating remediation plans, tracking progress in systems of record, and working with application managers, infrastructure teams, vendor managers, and risk partners to meet remediation timelines. The role also supports vulnerability exceptions, reporting, and continuous improvement. US citizenship is required.

Requirements

3–5+ years of experience in vulnerability management, vulnerability remediation, patch management, or a closely related infrastructure security role.
Hands-on experience with vulnerability assessment and management tools, including Tenable Security Center, Nessus, and Qualys.
Working knowledge of Windows Server 2019 and later, including vulnerability remediation, security patching, and system configuration.
Experience supporting Linux environments, particularly RHEL 9.x and later, including security updates, patching, and vulnerability remediation.
Understanding of CVE and CVSS analysis, vulnerability prioritization, exploitability, threat intelligence, asset criticality, and exposure-based remediation.
Experience coordinating vulnerability remediation and patch management, tracking findings through closure, and working with technical teams to resolve security issues.
Familiarity with change management processes and ability to coordinate remediation while supporting operational stability and established controls.
Experience using ServiceNow ticketing or similar systems to track vulnerabilities, document remediation progress, manage escalations, and maintain records.
Strong Microsoft Excel and reporting skills, including analyzing vulnerability data, tracking metrics, identifying trends, and communicating risk status.
Strong written and verbal communication skills and ability to collaborate with application owners, infrastructure teams, vendors, and risk stakeholders.
Strong analytical, organizational, and troubleshooting skills, including the ability to manage multiple priorities in a deadline-driven environment.
Ability to work within a regulated cloud environment and follow security, compliance, documentation, and risk management processes.
US citizenship is required.
Bachelor's degree or equivalent experience with 5–6 years of experience, or a master's degree or equivalent experience with 4 years of experience.
Applicants must be authorized to work in the United States without current or future visa sponsorship.

Nice To Haves

Familiarity with FedRAMP, NIST SP 800-53, DISA STIGs, and federal cybersecurity compliance requirements.
Experience using CISA Known Exploited Vulnerabilities (KEV) information and other threat intelligence to prioritize remediation.
Experience supporting US federal government, Department of Defense, or other regulated enterprise environments.
Experience with PowerShell, Bash, or Python for automation of vulnerability analysis, reporting, patch management, or remediation workflows.
Familiarity with ManageEngine Endpoint Central or similar endpoint management and patch deployment platforms.
Experience supporting VMware environments and Active Directory infrastructure.
Experience identifying and coordinating remediation of application vulnerabilities, including web application security findings.
Familiarity with cloud security technologies and AI-assisted tools for vulnerability analysis, security operations, and risk reduction.
A track record of improving remediation timelines, reporting processes, and technology risk reduction through coordination and automation.
Relevant cybersecurity, vulnerability management, infrastructure security, or cloud security certifications; examples include CompTIA Security+, CompTIA CySA+, and CISSP.

Responsibilities

Lead and coordinate vulnerability remediation across infrastructure and applications, tracking findings through resolution according to security requirements and remediation timelines.
Prioritize vulnerabilities using CVE and CVSS data, exploitability, threat intelligence, asset criticality, attack paths, exposure information, and other risk indicators.
Support remediation aligned with applicable CISA BOD 26-04 requirements and other federal cybersecurity directives, including monitoring deadlines.
Support vulnerability assessment and remediation in Windows Server 2019 and later, Linux/RHEL 9.x and later, and application environments.
Use Tenable Security Center, Nessus, and Qualys to review findings, validate remediation, identify exposures, and support vulnerability management operations.
Collaborate with application owners and managers, infrastructure teams, vendor managers, and risk partners to communicate findings and drive remediation to closure.
Maintain accurate vulnerability records in ServiceNow or other designated systems of record, including status, actions, and outstanding items.
Coordinate patching and remediation through established change management processes.
Support vulnerability exception management, risk-based remediation decisions, incident-driven responses, and escalation of overdue or unresolved vulnerabilities.
Use cloud-based AI tools, where appropriate, to support vulnerability identification, analysis, prioritization, and remediation workflows.
Develop and maintain vulnerability metrics and reports covering remediation progress, aging and overdue findings, risk trends, and remediation effectiveness.
Improve vulnerability management procedures, workflows, reporting accuracy, and operational efficiency, and maintain clear supporting documentation.