Security Engineer, Exposure and Vulnerability Management

Fluidstack•Austin, TX

2d•$224,000 - $275,000

About The Position

Fluidstack is hiring a Security Engineer to own exposure and vulnerability management across its infrastructure and corporate estate. The role spans external attack surface, cloud and Kubernetes, corporate endpoints, network infrastructure, and bare-metal systems. It also covers patch posture, approved-baseline drift, unmanaged applications and SaaS, endpoint packages, and browser and IDE extensions. The engineer will build the systems and automation behind the program, including asset inventory, scanner orchestration, deduplication, and prioritization based on reachability and real-world exploitation rather than raw CVSS alone. They will integrate remediation into existing team workflows, make findings actionable and verifiable, and work directly with system-owning teams to implement fixes. The scope also includes less commonly covered areas such as BMC and device firmware, GPU drivers, fleet-scale host images, and data center equipment. The role runs intake for penetration-test findings and external reports and communicates exposure clearly, including reachability, active exploitation, and accepted risk.

Requirements

Experience building vulnerability management as an engineering program using pipelines, automation, and integrations rather than spreadsheet triage.
Ability to write production-quality automation in Python or a similar language and integrate scanners, asset systems, and ticketing systems.
Experience prioritizing vulnerabilities using KEV, EPSS, reachability, and informed judgment.
Experience personally fixing vulnerabilities in codebases or infrastructure, with changes accepted and merged.
Experience driving remediation at scale across teams that do not report to you while maintaining credible SLAs and working relationships.
Ability to assess less commonly covered technology classes, such as firmware, GPU stacks, or data center equipment, and establish a defensible assessment approach.
Experience running vulnerability and exposure coverage on corporate endpoints and third-party software, including unmanaged applications, packages, and extensions.

Nice To Haves

Experience with external attack surface management platforms.
Depth in firmware or BMC security.
Experience with CSPM or KSPM tooling.
Experience in exploit development or reachability validation.
Experience with endpoint management and patching tooling such as MDM and EDR.
Experience with software inventory and extension and supply-chain risk.

Responsibilities

Own exposure and vulnerability management across the external attack surface, cloud and Kubernetes, corporate endpoints, network infrastructure, and bare-metal fleet.
Extend vulnerability management across macOS, Windows, and Linux corporate systems, including operating-system and application patch posture, first- and third-party software, and drift from approved baselines.
Identify, assess, and drive remediation or removal of unmanaged applications and SaaS, endpoint packages such as npm, PyPI, and Homebrew, and browser and IDE extensions.
Build asset inventory, scanner orchestration, deduplication, and prioritization systems based on reachability and real-world exploitation.
Integrate remediation into existing workflows so findings become owned tickets, fixes use existing pipelines, and closure is automatically verified.
Implement fixes alongside system-owning teams, including writing patch pull requests, hardening base images, fixing infrastructure-as-code modules, and shipping configuration changes.
Develop defensible assessment approaches for BMC and device firmware, GPU drivers, host images at fleet scale, and data center equipment.
Manage intake of penetration-test findings and external reports.
Report exposure accurately, including what is reachable, what is being exploited in the wild, and what risk has been accepted and by whom.
Drive remediation across teams that do not report to the role holder and maintain credible service-level agreements.