Senior Security Engineer, Vulnerability Management

CoreWeave • Sunnyvale, CA

1d • $139,000 - $204,000

About The Position

CoreWeave is hiring a Senior Security Engineer to own key technical work in its Vulnerability Management program. The role builds and improves triage, prioritization, and remediation-tracking systems across application, infrastructure, and hardware domains. The engineer delivers scoped projects, contributes to technical standards and architecture decisions, and works closely with senior engineers and stakeholders to drive execution.

The position encompasses end-to-end vulnerability management projects, production security automation, vulnerability assessment and detection workflows, ticket routing, remediation tracking, technical metrics, and risk reporting. It also involves investigating hardware-adjacent vulnerabilities—including GPU and DPU firmware, BlueField, and BMC surfaces—supporting responses to embargoed disclosures and zero-day events, and contributing to prioritization models and exception workflows. The engineer participates in root-cause analysis, improves workflow reliability and remediation speed, and shares knowledge through code reviews, documentation, and onboarding.

The role requires collaboration with security, engineering, and operational stakeholders. CoreWeave describes its environment as fast-moving and in a period of hyper-growth, with an emphasis on curiosity, ownership, employee empowerment, client experience, teamwork, collaboration, and innovative problem-solving. This position requires access to export-controlled information; applicants must meet applicable U.S. export-control eligibility requirements.

The base salary range is $139,000–$204,000. Starting salary depends on job-related knowledge, skills, experience, and market location. The total rewards package includes a discretionary bonus, equity awards, and benefits, subject to eligibility. The listed benefits reflect U.S.-based offerings for full-time employees; benefits may vary by location.

Requirements

• At least 5 years of relevant experience in vulnerability management, application security, platform security, or cloud security engineering.
• Experience building security automation, such as SOAR workflows, AI/ML systems, or detection pipelines, in production environments.
• Working knowledge of vulnerability management best practices, including CVSS, EPSS, CISA KEV, threat intelligence integration, and risk-based prioritization frameworks.
• Strong development background and coding skills in Python, Go, or similar languages for building production-grade security systems.
• Hands-on experience with modern vulnerability management tooling, such as Wiz, Semgrep, Rapid7, Tenable, or equivalent.
• Track record of collaborating across teams to deliver technical projects.
• Understanding of how security decisions affect engineering velocity, customer trust, and business outcomes.
• Must meet applicable U.S. export-control eligibility requirements for access to export-controlled information.

Nice To Haves

• Familiarity with specialized infrastructure, such as GPU/DPU environments, firmware security, hardware vulnerabilities, or high-performance computing.
• Experience building AI/ML-powered security systems, including LLM integration, automated decision-making, and human-in-the-loop validation.
• Exposure to hardware vendor security work, including embargoed disclosures and pre-release collaboration.
• Experience with security automation platforms such as TINES and serverless frameworks such as AWS Lambda or GCP Cloud Functions.
• DevOps, DevSecOps, or SRE background with experience in AWS, GCP, or Azure cloud services and Infrastructure as Code such as Terraform or CloudFormation.
• Working knowledge of Kubernetes security, including container scanning, admission controllers, supply chain security, and runtime protection.
• Experience in fast-growing startup or cloud-native environments.
• Experience managing vulnerabilities in a FedRAMP-certified environment or under similar regulatory frameworks.

Responsibilities

• Own Vulnerability Management technical projects end to end and contribute to architecture decisions for areas of the program.
• Build and maintain triage automation, including integrations, decision logic, and production hardening.
• Implement workflow components spanning assessment and detection, ticket routing, and remediation tracking.
• Investigate and triage hardware-adjacent vulnerabilities, including GPU firmware, DPU firmware/BlueField, and BMC surfaces, alongside senior engineers.
• Support responses to embargoed disclosures and zero-day events, working with owner teams that deploy fixes.
• Contribute to prioritization logic, severity models, and exception workflows through code, design reviews, and technical proposals.
• Build technical metrics and risk reporting to inform program and leadership decisions.
• Participate in root-cause analysis for vulnerability incidents and implement technical improvements.
• Share knowledge through code reviews and documentation, and help onboard new teammates.
• Partner with security, engineering, and operational stakeholders to improve workflow reliability and accelerate remediation.

Benefits

• Discretionary bonus and equity awards, subject to eligibility.
• Medical, dental, and vision insurance, 100% paid for by CoreWeave.
• Company-paid life insurance.
• Voluntary supplemental life insurance.
• Short- and long-term disability insurance.
• Flexible Spending Account.
• Health Savings Account.
• Tuition reimbursement.
• Ability to participate in the Employee Stock Purchase Program (ESPP).
• Mental wellness benefits through Spring Health.
• Family-forming support provided by Carrot.
• Paid parental leave.
• Flexible, full-service childcare support with Kinside.
• 401(k) with a generous employer match.
• Flexible PTO.
• Catered lunch each day in office and data center locations.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed