Vulnerability Management Specialist
About The Position
As a member of AppFolio’s security engineering team, the Vulnerability Management Specialist contributes to security initiatives and high-impact projects, provides expertise and support to teammates, and continues developing skills while staying current with industry trends and technology. The role calls for a strong interest in computer, network, and application security; experience in vulnerability management at a Software-as-a-Service company is preferred. The specialist validates, prioritizes, communicates, and tracks vulnerabilities to improve the security posture of AppFolio’s technology systems and applications. They respond to emerging threats and potential security events as zero-day vulnerabilities are released, support compliance with vulnerability management policies and procedures, and promote industry best practices. The role also streamlines vulnerability management through artificial intelligence, machine learning, and automation to improve the end-to-end process and reduce time to action. An effective program helps build trust with customers and partners.
Requirements
- Bachelor of Science in Computer Science or a related technical discipline, or equivalent industry experience.
- Two to five years of experience in a related cybersecurity role, preferably focused on Vulnerability Management, Penetration Testing, or Incident Response.
- Ability to write scripts in Ruby, Python, or other scripting languages.
- Hands-on experience with vulnerability management tools such as DefectDojo, Invicti, Wiz, or Cycode.
- Hands-on experience with manual testing tools, especially for validating vulnerabilities.
- Understanding of the capabilities and limitations of SAST, DAST, SCA, and penetration-testing tools.
- Proficiency with Linux, macOS, and Windows operating systems.
- Ability to assess vulnerability-related security risks and prioritize them using frameworks such as CVSS while accounting for local environmental factors.
- Strong communication skills and ability to explain complex security issues to technical and non-technical stakeholders.
- Ability to stay organized while overseeing complex security findings and applying structured project-style oversight to guide multiple vulnerabilities to remediation or risk acceptance.
- Cybersecurity-relevant certifications, such as GCIA, GCIH, CEH, CISSP, CISM, or OSCP.
- Project-management-relevant certifications, such as CAPM or PMP.
Nice To Haves
- Experience in vulnerability management at a Software-as-a-Service company.
- Hands-on experience with network protocol vulnerabilities.
- Experience identifying and managing vulnerabilities during CI/CD.
- Hands-on experience in cloud environments such as AWS, GCP, or Azure.
- Hands-on experience with Burp Suite and Tenable or similar tools.
- Hands-on experience with Metasploit Framework or similar tools.
Responsibilities
- Validate, prioritize, communicate, and track vulnerabilities to improve the security posture of technology systems and applications.
- Respond to emerging threats and potential security events as zero-day vulnerabilities are released.
- Help ensure compliance with vulnerability management policies, processes, and procedures, and drive adoption of emerging industry best practices.
- Use artificial intelligence, machine learning, and automation to streamline vulnerability management and reduce time to action for known vulnerabilities.
- Maintain an exceptional vulnerability management program that builds trust and confidence with customers and partners.
- Provide expertise and support to team members in areas of strength.
- Stay abreast of industry trends and technology and continue developing skills and competencies.
Benefits
- Regular full-time employees are eligible for benefits; specific benefits are not listed in the posting.
- The company describes total rewards and opportunities for growth, coaching, mentorship, and time and tools to develop skills.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
