Senior Threat and Vulnerability Engineer

United Wholesale Mortgage•Pontiac, MI

3d•Onsite

About The Position

United Wholesale Mortgage (UWM) is seeking a Threat and Vulnerability Engineer to protect its digital assets, data, and infrastructure from evolving cyber threats. The role identifies, assesses, prioritizes, and supports remediation of vulnerabilities across networks, applications, cloud environments, and endpoints, helping continuously improve UWM’s security posture. The engineer conducts regular and ad-hoc vulnerability scans, analyzes results and prioritizes risks, researches emerging threats and security technologies, and contributes to threat modeling. The role collaborates with IT operations, development teams, and other stakeholders to communicate findings, guide remediation, validate fixes, and develop security controls. It also produces vulnerability and security posture reports, maintains security documentation, and supports the Security Operations Center and Incident Response teams during security incidents. This position is not eligible for employer-sponsored work authorization now or in the future. Applicants must be authorized to work in the United States without employer sponsorship. UWM describes the position as campus-based and highlights its campus amenities. Employment is at-will, and duties may change or include other job-related tasks, subject to reasonable accommodation.

Requirements

Bachelor’s degree in computer science, information security, or a related technical field, or equivalent practical experience.
At least 5 years of information security experience, with a strong focus on vulnerability management, penetration testing, or security engineering.
Solid understanding of networking protocols such as TCP/IP, DNS, and HTTP; Windows and Linux operating systems; and common enterprise applications.
Proficiency with industry-standard vulnerability scanning tools.
Experience with web application security testing tools and understanding of the OWASP Top 10.
Familiarity with cloud security principles and practices in AWS, Azure, or GCP.
Knowledge of security frameworks and compliance requirements such as NIST, ISO 27001, and GLBA.
Scripting skills, such as Python, PowerShell, or Bash, for automation and analysis.
Strong analytical, problem-solving, and critical-thinking skills.
Excellent written and verbal communication skills, including the ability to explain complex technical information to technical and non-technical audiences.
Ability to work independently and collaboratively in a fast-paced, dynamic environment.
Must be authorized to work in the United States without employer sponsorship; employer-sponsored work authorization is unavailable.

Nice To Haves

Relevant security certifications such as CISSP, OSCP, CEH, CompTIA Security+, or GIAC certifications such as GSEC, GWAPT, or GPEN.
Familiarity with DevSecOps principles and integrating security into the CI/CD pipeline.
Experience in the financial services or mortgage industry.

Responsibilities

Conduct regular and ad-hoc vulnerability scans across servers, workstations, network devices, cloud platforms, and web applications.
Analyze scan results, identify false positives, and prioritize vulnerabilities based on risk, severity, and potential business impact.
Assist in optimizing vulnerability management tools and platforms to ensure accurate and comprehensive coverage.
Stay current on cybersecurity threats, vulnerabilities, attack techniques, and industry best practices.
Research and evaluate tools, technologies, and methodologies to enhance UWM’s security posture.
Contribute to threat modeling exercises for new and existing systems.
Collaborate with IT operations, development teams, and other stakeholders to communicate vulnerability findings and guide remediation.
Track remediation progress, validate fixes, and report on the vulnerability management lifecycle.
Develop and implement security controls and processes to mitigate identified risks.
Generate reports on vulnerability status, remediation efforts, and security posture for different audiences.
Maintain documentation of security processes, procedures, and configurations.
Assist the Security Operations Center and Incident Response teams during security incidents by providing vulnerability context and information on potential attack vectors.

Benefits

Paid time off after 30 days.
Additional parental and maternity leave benefits after 12 months.
Adoption reimbursement program.
Paid volunteer hours.
Paid training and career development.
Medical, dental, vision, and life insurance.
401(k) with employer match.
Mortgage discount and area business discounts.
Free membership to a fitness center, including exercise classes and sports leagues.
Wellness area with an in-house primary-care physician’s office, a full-time massage therapist, and a hair salon.
Gourmet cafeteria featuring homemade breakfast and lunch.
Convenience store with healthy grab-and-go snacks.
In-house Starbucks and Dunkin.
Indoor/outdoor café with Wi-Fi.