Technology Vulnerability Management Engineer

Position Overview

Cooley is seeking a Technology Vulnerability Management Engineer to join the Security team. In this role, you will lead the full vulnerability management lifecycle across endpoints, servers, applications, containers, and cloud environments. You will own discovery, validation, risk-based prioritization, and remediation outcomes while ensuring exceptional customer service and technical excellence.

Key Responsibilities

• Support the development and continuous optimization of vulnerability management services, including scanning cadence, exception handling, SLAs and alignment with security controls.
• Build and maintain standards, playbooks, and repeatable processes to improve the efficiency and maturity of the vulnerability management program.
• Administer and optimize enterprise vulnerability management platforms (e.g., Tenable, Qualys, Rapid7) to ensure accurate asset coverage.
• Integrate asset context from CMDB, EDR, and cloud inventory for effective risk-based prioritization.
• Build automation for data ingestion, deduplication, ticketing, and reporting using APIs, scripting, and other tools to improve data quality and reduce false positives.
• Analyze and interpret vulnerability scan results to assess severity, validate findings, and provide actionable remediation recommendations.
• Publish dashboards and reports tailored for engineers, management, and executive leadership to communicate progress and risk.
• Drive remediation efforts, including patching, configuration baselines, and compensating controls, and validate results through rescans or attestations.
• Partner with developers, DevOps, and other stakeholders to implement "shift-left" practices such as pipeline scanning, container/base-image hygiene, and Infrastructure-as-Code (IaC) hardening.
• Collaborate with cross-functional teams to implement security solutions and controls that mitigate identified vulnerabilities.
• Support audits, assessments, and regulatory compliance requirements by providing accurate documentation and evidence.
• Identify opportunities for process improvements, tool optimization, and template standardization to increase efficiency and reduce operational overhead.
• Stay current on emerging threats, vulnerabilities, and industry best practices to ensure the program remains effective and modern.
• Contribute to advanced security testing activities such as penetration testing, application reviews, and targeted vulnerability assessments as needed.
• Assist with incident response activities by providing vulnerability context, supporting root cause analysis, and helping to validate containment and remediation actions.
• Perform any other duties as assigned or required.

Required Qualifications

• After orientation at Cooley LLP, exhibit proficiency in Microsoft 365, MECM, Intune, iManage, and other firm applications.
• Ability to work extended and/or weekend hours, as required.
• 2+ years of experience in cybersecurity, vulnerability management, or penetration testing. Senior candidates must have 5+ years of directly applicable experience.
• Hands-on experience conducting vulnerability scans, including configuration and use of tools such as Tenable, Qualys, and Rapid7.
• Knowledge of cybersecurity frameworks, controls, standards, and best practices.
• Solid understanding of Windows/Linux, networks, web/application stacks, and at least one major cloud provider (AWS/Azure).
• Proficiency in Python or PowerShell and REST APIs with the ability to build repeatable pipelines/dashboards.
• Familiarity with CVSS, KEV, EPSS and how they align with risk frameworks.
• Experience in generating and disseminating easily digestible metrics and reports to system owners and leadership.

Preferred Qualifications

• Bachelor's Degree in Information Technology or Computer Information Systems.
• Knowledge of the Mitre ATT&CK framework and NIST Cyber Security Framework.
• Familiarity with common enterprise security controls (Firewall, Proxy, AV, SIEM, etc.).
• Experience with incident response procedures.
• Deep understanding of security issues, techniques, and implications across multiple computer platforms.
• Proven experience leading and mentoring teams through technical guidance and project leadership.
• Understanding of security regulations and best practices such as the ISO 27000 family of standards.
• Ability to communicate technical information effectively to business clients and less experienced technologists.
• Relevant certifications such as CISSP, CISM or equivalent.
• Experience with CI/CD pipelines.
• Cloud Architecture and/or Cloud Security Certifications (AWS, Azure, GCP).
• Certifications from the Cloud Security Alliance (e.g., CCSP, CCSK) or (ISC)² credentials.
• Additional security certifications are a plus.

Benefits & Perks

• Competitive Compensation: Expected annual pay range is $110,000 - $155,000; final offer depends on geographic location, experience, and skillset. Senior candidates may be eligible for a higher salary range.
• Excellent Benefits Package: Includes medical, health savings accounts (with applicable medical plan), dental, vision, and health or dependent care flexible spending accounts.
• Pre-tax commuter benefits, life insurance, AD&D, long-term care coverage, and backup care for children and/or adults.
• Firm-paid benefits include life insurance, AD&D, LTD, short term medical benefits, plus 21 days of Paid Time Off (PTO) and 10 paid holidays annually.
• Generous parental leave, fertility benefits, and a comprehensive benefit orientation for new employees.