Senior Engineer, Exposure & Vulnerability Management

Recursion

2h•$134,200 - $180,600•Remote

About The Position

The Senior Engineer, Exposure & Vulnerability Management will help Recursion move from periodic vulnerability scans to continuous, risk-driven exposure management. The role builds multi-agent systems that take vulnerabilities from discovery through verified closure, with approval gates, audit trails, and rollback controls. It also develops prioritization based on reachability, attack paths, business criticality, and live exploit intelligence, helping engineering teams focus on exposures that are genuinely exploitable. The role drives Recursion’s Continuous Threat Exposure Management (CTEM) strategy across products, platforms, cloud and on-premise infrastructure, and corporate applications. It assesses and evolves the exposure and vulnerability management program in support of business outcomes and the organization’s zero-trust approach. The engineer partners with Engineering and IT to embed secure-by-default practices, integrate remediation with ticketing and CI/CD workflows, and align remediation timelines with risk. The role also defines measures of control effectiveness and supports regulatory compliance, including standards such as SOC2. This is a remote position based in the United States. Remote employees are expected to make regular on-site visits for routine work and departmental events. The position is eligible for an annual bonus, equity compensation, and a comprehensive benefits package.

Requirements

Bachelor’s or Master’s degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
At least 7 years of experience in vulnerability management, exposure management, or related information security domains, including leading large-scale programs from strategy through execution in cloud-first and hybrid environments.
Deep understanding of security principles and a track record of turning vulnerability data into prioritized, owned, and verified remediation.
Hands-on experience building or deploying AI/LLM-based agents or multi-agent systems for security or engineering workflows, including orchestration, tool use, and evaluation.
Working knowledge of approval workflows, audit logging, and rollback controls for automated remediation, including risks of agent-driven changes.
Proficiency in one or more programming languages, such as Python, Go, or Java, and strong scripting skills for automation and integration.
Expert-level experience with vulnerability and exposure management platforms such as Tenable, Qualys, Rapid7, or equivalent, and with CTEM, attack surface management, and attack-path analysis tools.
Strong command of risk-based prioritization, including CVSS, EPSS, CISA KEV, reachability analysis, and threat intelligence feeds.
Experience with cloud platforms (AWS, Azure, or GCP), container and Kubernetes security, and Infrastructure-as-Code tools such as Terraform or CloudFormation for automated remediation.
Experience with CI/CD pipelines, SCA/SAST tooling, and software supply chain security, including SBOMs and dependency mapping.
Knowledge of UNIX/Linux, macOS, and Windows operating systems, networking, and database management systems.
Experience with risk management and ensuring solutions align with organizational risk tolerance and compliance requirements such as SOC2, GxP, or similar.

Nice To Haves

Relevant security certifications, such as CISSP, OSCP, or GWAPT, are highly desirable.

Responsibilities

Design and deploy multi-agent systems that move exposures from discovery to closure, including analysis, dependency mapping, patch or Infrastructure-as-Code update generation, and validation.
Build appropriate approval gates, audit trails, and rollback controls into automated remediation workflows.
Develop exposure-prioritization engines using real-time reachability, attack-path context, business criticality, and live exploit intelligence rather than relying solely on static CVSS scores.
Automate verification to distinguish theoretical vulnerabilities from actively exploitable conditions and reduce alert noise.
Drive the Continuous Threat Exposure Management strategy, establishing a proactive, around-the-clock security posture across products, platforms, cloud and on-premise infrastructure, and corporate applications.
Assess and revamp the exposure and vulnerability management program to accelerate business outcomes and support the broader zero-trust security approach.
Architect cloud-native discovery, asset-inventory, and remediation workflows, integrating them with ticketing, CI/CD, and configuration management.
Partner with Engineering and IT to embed secure-by-default practices in product and application development, deployment, and patching, with remediation timelines matched to risk.
Define KPIs, KCIs, and KRIs, such as mean time to remediate, exploitable-exposure backlog, and critical-asset coverage, to measure control effectiveness and guide improvement.
Work with partner teams to design exposure and vulnerability controls that support regulatory compliance, including SOC2.