Senior Security Specialist, Vulnerability Management

Viasat, Inc.•Carlsbad, CA

10d

About The Position

One team. Global challenges. Infinite opportunities. At Viasat, we’re on a mission to deliver connections with the capacity to change the world. For more than 35 years, Viasat has helped shape how consumers, businesses, governments and militaries around the globe communicate. We’re looking for people who think big, act fearlessly, and create an inclusive environment that drives positive impact to join our team.

Requirements

5+ years of experience in Vulnerability Management, with at least 3 years dedicated specifically to tactical vulnerability management.
In-depth knowledge of modern vulnerability evaluation frameworks, including EPSS, CVSS, SSVC, and KEV.
Demonstrable experience preparing for and participating in external third-party security audits (e.g., ISO 27001, PCI, or CMMC).
Demonstrated ability to confidently explain vulnerability prioritizations, technical workarounds, and formal risk acceptance/exception decisions to both internal compliance teams and external auditors.
Deep hands-on experience with enterprise scanners and cloud-native security platforms.
Good understanding of operating system internals, container environments, and cloud security fundamentals.
Demonstrable ability to translate complex vulnerability details into clear, actionable technical instructions for engineering partners without direct authority.
Analyze internal data against new CVEs and vulnerability disclosures to identify critical risks relevant to our infrastructure and work to mitigate them.
Act as the VM first-responder during critical, zero-day disclosures. Quickly scope our exposure, assess the blast radius across infrastructure and codebases, and coordinate response efforts.
Design automated dashboards that track operational efficiency metrics, such as Mean Time to Detect (MTTD) relevant CVEs and Mean Time to Remediate (MTTR).
Serve as the technical point of contact during internal and external audits. Interface directly with auditors to demonstrate program maturity and explain vulnerability scanning methodologies.
Build automated reports and dashboards that pull audit evidence on demand. Examples include proof of patching SLA alignment, historical scanning cadences, and approved risk exceptions. This reduces manual preparation time.

Nice To Haves

Familiarity/Experience with AI technologies, with a strong preference for knowledge in AI risk and governance frameworks (experience applying these concepts to vulnerability management is a major plus).
Experience with penetration testing methodologies and tools to help validate vulnerability exploitability and assist with remediation prioritization.
Prior experience building security pipelines inside automation and orchestration platforms.
Familiarity with CI/CD tools and automated configuration/deployment environments.
A passion for following emerging threats, exploit trends, and security research.
SANS GPEN or GEVA.
experience in assessments or penetration testing of web applications and Internet-facing tech stacks.

Responsibilities

Efficiently evaluate and respond to the daily influx of newly disclosed CVEs, cutting through the noise to separate theoretical risks from immediate, real-world threats to our business
Prioritize what needs to be fixed and how to do it efficiently—whether that means coordinating a full software/OS update, deploying a temporary configuration workaround, or implementing compensating security controls.
Track down and identify the exact system owners and engineering teams responsible for vulnerable assets, ensuring every high-priority vulnerability is routed to the right person for swift remediation.
Design concepts and build them with fellow security engineers to automate the process allowing us to handle a high volume of threats without increasing manual overhead.
Function as the technical representative during internal and external audit reviews.
Collaborate directly with auditors to illustrate program maturity and detail vulnerability scanning methodologies.
Create automated dashboards to track operational efficiency metrics, including Mean Time to Detect (MTTD) relevant CVEs and Mean Time to Remediate (MTTR).
Serve as the VM initial responder during urgent, zero-day vulnerability revelations. Quickly scope our exposure, assess the blast radius across infrastructure and codebases, and coordinate response efforts.
Develop automated data visualizations and reporting tools. These tools retrieve audit evidence on demand, such as proof of patching SLA adherence, historical scanning cadences, and approved risk exceptions. This reduces time spent on manual preparation.
Analyze internal data against advisories to identify critical risks relevant to our infrastructure and work to mitigate them.
Function as the VM first-responder during critical, zero-day disclosures. Rapidly determine our exposure, evaluate the blast radius throughout infrastructure and codebases, and coordinate response efforts.
Design automated dashboards that track operational efficiency metrics, such as Mean Time to Detect (MTTD) relevant CVEs and Mean Time to Remediate (MTTR).
Serve as the technical point of contact during internal and external audits. Interface directly with auditors to demonstrate program maturity and explain vulnerability scanning methodologies.
Analyze internal data against new CVEs and vulnerability disclosures to identify critical risks relevant to our infrastructure and work to mitigate them.
Act as the VM first-responder during critical, zero-day disclosures. Quickly scope our exposure, assess the blast radius across infrastructure and codebases, and coordinate response efforts.
Design automated dashboards that track operational efficiency metrics, such as Mean Time to Detect (MTTD) relevant CVEs and Mean Time to Remediate (MTTR).
Serve as the technical point of contact during internal and external audits. Interface directly with auditors to demonstrate program maturity and explain vulnerability scanning methodologies.
Build automated reports and dashboards that pull audit evidence on demand. Examples include proof of patching SLA alignment, historical scanning cadences, and approved risk exceptions. This reduces manual preparation time.