Senior Cyber Security Engineer

Direct Supply•Milwaukee, WI

21h

About The Position

Direct Supply is building healthcare technology products, solutions, and platforms intended to improve the lives of seniors and their caregivers. The Senior Cyber Security Engineer identifies, assesses, and reduces cybersecurity risks across Direct Supply’s technology environments. The role provides hands-on technical expertise and operational ownership of vulnerability management and penetration testing to strengthen security controls, reduce exposure, and protect business systems and information. Reporting to the Director of Information Security, the engineer works independently and collaborates with engineering, operations, and security teams to drive remediation, improve security processes, and deliver measurable improvements to the company’s security posture.

Requirements

Bachelor’s degree in Computer Science, Engineering, Information Security, or a related field.
At least 6 years of progressive experience in information security or security engineering, including hands-on vulnerability management and penetration testing.
Expertise in vulnerability assessment, security scanning platforms, asset coverage, finding validation, and risk-based prioritization.
Hands-on experience conducting internal and external penetration testing, including manual validation, controlled exploitation, security risk assessment, and technical reporting.
Experience operating, configuring, and troubleshooting security platforms and automating security workflows.
Experience assessing vulnerabilities and security risks across infrastructure, cloud, and application environments, including complex cloud environments.
Ability to independently investigate complex security issues, identify root causes, and recommend practical corrective actions.
Experience coordinating external security testing providers and communicating technical findings, remediation priorities, and security risks to technical stakeholders and leadership.

Nice To Haves

OSCP, GPEN, GWAPT, or relevant vulnerability management certifications.
Scripting and API integration experience.
Experience testing web applications, APIs, and cloud environments.

Responsibilities

Own vulnerability management operations, including processes, security scanning tools, and coverage across infrastructure, cloud, and application environments.
Analyze and prioritize vulnerabilities by validating findings and assessing exploitability, asset criticality, and business impact.
Coordinate vulnerability remediation with engineering and operations teams, track progress, verify fixes, and escalate unresolved risks.
Automate scanning, ticketing, and reporting workflows to improve efficiency and consistency and reduce manual effort.
Monitor and report security metrics, including scanning coverage, remediation progress, overdue vulnerabilities, and recurring risks.
Plan and execute internal and external penetration testing by defining scope, conducting security tests, and identifying exploitable weaknesses.
Validate security weaknesses and potential attack paths using automated discovery, manual testing, and controlled exploitation; assess business impact and deliver actionable findings.
Coordinate external penetration testing services, including scope, schedules, access, deliverables, provider performance, coverage, and quality.
Drive resolution of penetration testing findings by validating results, providing remediation guidance, coordinating corrective actions, and retesting fixes.
Analyze root causes, recommend improvements to system designs and configurations, and share technical knowledge to prevent recurring vulnerabilities.