2 hours ago
Responsibilities
- Assess vulnerabilities across applications, operating systems, containers, Kubernetes clusters, and third-party dependencies.
- Investigate direct and transitive dependencies and recommend safe upgrades, configuration changes, patches, or compensating controls.
- Own and maintain repositories, scheduled jobs, APIs, reporting applications, dashboards, and automation supporting vulnerability management.
- Integrate security tools with ticketing systems, repositories, dashboards, and reporting platforms through APIs and webhooks.
- Use approved AI-assisted development tools for coding, debugging, research, remediation analysis, testing, documentation, and security automation.
- Identify false positives, duplicate findings, incorrect asset associations, and findings lacking sufficient context.
- Partner with engineering and infrastructure teams to prioritize vulnerabilities based on exploitability, exposure, asset criticality, and business impact.
- Develop reports and dashboards covering vulnerability risk, remediation progress, SLA performance, and program effectiveness.
- Lead remediation initiatives and provide technical guidance to engineers and security team members.
Requirements
- Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, or equivalent practical experience.
- At least 4 years of experience in information security, vulnerability management, application security, security engineering, or a related discipline.
- Strong understanding of CVE, CVSS, CWE, CISA KEV, EPSS, OWASP, and risk-based vulnerability prioritization.
- Experience analyzing vulnerable dependencies through build files, dependency trees, lock files, container images, and software-composition-analysis tools.
- Hands-on experience with vulnerability-management platforms such as Qualys or similar tools.
- Experience with SAST, DAST, SCA, container-security, or infrastructure vulnerability-scanning tools.
- Experience developing or maintaining reporting applications, dashboards, backend services, or data-processing workflows.
- Familiarity with containers, Kubernetes workloads, Helm, CI/CD pipelines, configuration management, logging, monitoring, and secrets management.
- Proficiency in at least one programming or scripting language such as Python, Java, Go, or Bash.
- Ability to independently manage technical initiatives involving multiple engineering teams and stakeholders.
- Preferred experience with cloud platforms, cloud-native services, microservice architectures, Kubernetes-based applications, vulnerability-management automation, and self-service security tools.
- Preferred knowledge of Java dependency-management systems such as Gradle or Maven, including transitive dependency analysis.
- Preferred ability to collaborate with engineering, infrastructure, business, compliance, and external vendor teams.
- Nice-to-have master’s degree, practical Kubernetes deployment and troubleshooting experience, relevant hands-on security certifications, and financial-services or regulated-industry experience.
Benefits
- Comprehensive and competitive benefits are provided through SoFi’s benefits program.
- Remote work cannot be accommodated from Hawaii, Alaska, or Puerto Rico.
Tech Stack
Categories
About SoFi
SoFi is a values-driven company on a mission to help our members get their money right. We create modern financial products and services that help people borrow, save, spend, invest, and protect their money better, so that they can achieve financial independence and realize their ambitions—from owning a home to saving for retirement, paying off their student loans, and more. CFL #6054612; NMLS #1121636 (www.nmlsconsumeraccess.org) Advisory services through SoFi LLC, a registered investment advisor. SoFi Checking and Savings is offered through SoFi Bank, N.A. Member FDIC. SoFi Money™ is offered through SoFi Securities LLC, member FINRA/SIPC.