Principle, Vulnerability Analyst

Mastercard•O'fallon, MO

1d•$152,000 - $258,000•Onsite

About The Position

The AI Vulnerability Operations team is responsible for turning AI-identified security findings into validated, prioritized, and remediated risk reduction across Mastercard’s software environment. This position is for a Principal Vulnerability Analyst who will work directly with application, engineering, product, and security teams to validate vulnerabilities identified through AI models and drive them through remediation. The role will focus on determining whether AI-generated findings are exploitable, relevant, reachable, and material to the application or service being evaluated. This position will help translate AI model outputs into clear technical guidance, remediation actions, risk decisions, and measurable vulnerability reduction outcomes. The Principal Vulnerability Analyst will also provide feedback into AI vulnerability workflows to improve model precision, reduce false positives, identify missed context, and strengthen operational processes over time.

Requirements

Strong experience in vulnerability management, application security, secure software development, or security engineering, with demonstrated ability to validate and drive remediation of software vulnerabilities.
Deep understanding of common vulnerability classes, secure coding practices, OWASP, CWE, CVSS, exploitability analysis, threat modeling, and risk-based prioritization.
Experience reviewing source code, dependency manifests, software composition analysis results, static analysis findings, container findings, configuration evidence, and application architecture to determine real-world risk.
Ability to work directly with application teams to explain vulnerabilities, recommend practical fixes, resolve disagreements, and drive remediation to completion.
Strong analytical judgment to evaluate AI-generated findings, identify false positives, determine missing context, and distinguish theoretical risk from exploitable risk.
Experience with vulnerability tracking, remediation workflows, exception handling, risk acceptance, retesting, and closure evidence.
Familiarity with AI-assisted security workflows, including how model-generated findings can be validated, enriched, prioritized, and improved through analyst feedback.
Ability to communicate complex vulnerability details clearly to developers, product owners, security leaders, and non-technical stakeholders.
Strong written documentation skills, including the ability to produce validation notes, remediation guidance, risk narratives, executive summaries, and operational playbooks.
Experience collaborating across security, software engineering, product, platform, and operations teams in a large enterprise environment.
Strong leadership qualities, including mentoring, influencing without authority, driving accountability, and creating repeatable processes for others to follow.
Comfortable working in ambiguous, evolving environments where new AI-enabled workflows, tools, and processes are being developed and refined.
Ability to identify process improvements that reduce remediation friction, improve customer experience, and increase the quality and speed of vulnerability closure.

Responsibilities

Validate vulnerabilities identified by AI models by reviewing code context, dependency data, application architecture, runtime exposure, compensating controls, and exploitability evidence.
Partner with application and engineering teams to confirm ownership, assess impact, determine remediation options, and drive vulnerabilities to closure.
Translate AI-generated vulnerability findings into clear, actionable remediation guidance that engineering teams can implement efficiently.
Triage AI findings to distinguish true positives, false positives, duplicates, accepted risks, configuration issues, dependency issues, and findings requiring additional analysis.
Assess vulnerability severity using available evidence, including exploitability, reachability, data sensitivity, business criticality, external exposure, dependency paths, and compensating controls.
Facilitate remediation discussions with product owners, developers, security engineers, and platform teams to remove blockers and maintain momentum on high-risk issues.
Verify remediation outcomes by reviewing code changes, dependency updates, configuration changes, compensating controls, retest results, and supporting evidence.
Document validation rationale, remediation decisions, residual risk, and closure evidence in vulnerability tracking and reporting systems.
Identify patterns across AI-generated findings and recommend improvements to secure coding practices, dependency management, build processes, and application security controls.
Provide feedback to AI model, data, and platform teams on finding quality, missing context, false positives, false negatives, prompt or workflow gaps, and opportunities for better prioritization.
Support prioritization of AI-identified vulnerabilities across critical, externally exposed, and high-risk applications to ensure remediation efforts focus on the areas of greatest risk.
Create playbooks, decision trees, validation standards, and remediation guidance to make AI vulnerability operations more consistent and scalable.
Mentor analysts and engineers on vulnerability validation, risk-based prioritization, secure remediation practices, and effective engagement with application teams.
Prepare executive-ready summaries, risk narratives, metrics, and status updates that communicate remediation progress, blockers, and residual risk.
Continuously improve the AI vulnerability validation lifecycle by reducing manual effort, improving evidence quality, and strengthening handoffs between AI tooling, analysts, and engineering teams.

Benefits

insurance (including medical, prescription drug, dental, vision, disability, life insurance)
flexible spending account and health savings account
16 weeks of new parent leave
up to 20 days of bereavement leave
80 hours of Paid Sick and Safe Time
25 days of vacation time
5 personal days
10 annual paid U.S. observed holidays
401k with a best-in-class company match
deferred compensation for eligible roles
fitness reimbursement or on-site fitness facilities
eligibility for tuition reimbursement