Senior Cyber Security Engineer

Direct Supply•Milwaukee, WI

About The Position

Direct Supply is building healthcare technology products, solutions and platforms intended to improve the lives of seniors and those who care for them. The Senior Cyber Security Engineer identifies, assesses and reduces cybersecurity risks across Direct Supply’s technology environments. The role provides hands-on technical expertise and operational ownership of vulnerability management and penetration testing to strengthen security controls, reduce exposure, and protect business systems and information. Reporting to the Director of Information Security, the engineer works independently and collaborates with engineering, operations and security teams. The position focuses on effective remediation, improved security processes and measurable improvements in Direct Supply’s security posture. The job is to be performed in the location listed; no specific location or workplace arrangement is provided.

Requirements

Bachelor’s degree in Computer Science, Engineering, Information Security or a related field.
At least 6 years of progressive experience in information security or security engineering, including hands-on vulnerability management and penetration testing.
Expertise in vulnerability assessment, security scanning platforms, asset coverage, finding validation and risk-based prioritization.
Hands-on experience conducting internal and external penetration testing, including manual validation, controlled exploitation, security risk assessment and technical reporting.
Experience operating, configuring and troubleshooting security platforms and automating security workflows.
Experience assessing vulnerabilities and security risks across infrastructure, cloud and application environments, including complex cloud environments.
Ability to independently investigate complex security issues, identify root causes and recommend practical corrective actions.
Experience coordinating external security testing providers and communicating technical findings, remediation priorities and security risks to technical stakeholders and leadership.

Nice To Haves

OSCP, GPEN, GWAPT or relevant vulnerability management certifications.
Scripting and API integration experience.
Experience testing web applications, APIs and cloud environments.

Responsibilities

Own vulnerability management operations, including establishing processes, maintaining security scanning tools and ensuring reliable coverage across infrastructure, cloud and application environments.
Analyze and prioritize vulnerabilities by validating findings and assessing exploitability, asset criticality and business impact.
Coordinate vulnerability remediation with engineering and operations teams, monitor progress, verify fixes and escalate unresolved risks.
Automate scanning, ticketing and reporting workflows to improve efficiency, consistency and reduce manual effort.
Track and report security performance metrics, including scanning coverage, remediation progress, overdue vulnerabilities and recurring risks.
Plan and execute internal and external penetration tests by defining scope, conducting security testing and identifying exploitable weaknesses.
Validate security weaknesses and potential attack paths through automated discovery, manual testing and controlled exploitation; assess business impact and provide actionable findings.
Coordinate external penetration testing services, including scope, schedules, access and deliverables, and monitor provider performance.
Drive resolution of penetration testing findings by validating results, providing remediation guidance, coordinating corrective actions and retesting fixes.
Analyze root causes, recommend improvements to system designs and configurations, and share technical knowledge to help prevent recurring vulnerabilities.