Senior Security Engineer Vulnerability Management

We're not hiring someone to run scans. We're hiring someone to build the engine that finds and closes risk before it becomes an incident. We're looking for a Tech Lead who thinks like an attacker prioritizing targets, not an analyst clearing a scan queue. Someone who owns the full vulnerability lifecycle, builds AI-driven prioritization into the pipeline, and turns remediation into a measurable, automated system instead of a spreadsheet of open tickets.

You'll lead Vulnerability Management across cloud, infrastructure, endpoints, and internal environments - turning every scan, exception, and remediation into a shorter exposure window and a more mature program. The goal isn't to keep the vulnerability count low on a dashboard. It's to make exploitable exposure structurally rare.

Why This Matters

Deriv's mission is Trading for Anyone, Anywhere, Anytime. Millions of traders across the globe, around the clock, across regulatory environments. At this scale, an unpatched exposure sitting past its SLA isn't a compliance footnote - it's a trader's funds at risk and a regulator on the phone.

Vulnerability Management is a core defensive layer for a platform that never stops processing transactions. When new assets, cloud workloads, and code ship continuously, your discovery and remediation engine can't fall behind - which is exactly why this role exists to turn Vulnerability Management into a fully automated, intelligence-driven function.

The Challenge

Most vulnerability programs are a scan, a spreadsheet, and a monthly report nobody reads until an audit forces the question. That's not this role.

You'll own the vulnerability lifecycle end to end: discovery, enrichment, risk-based prioritization, remediation, validation, and executive reporting, across AWS, GCP, Azure, Kubernetes, containers, endpoints, and network infrastructure. You'll be building automated workflows and AI-assisted prioritization that cut exposure windows quarter over quarter, not chasing CVSS scores in isolation.

If your idea of vulnerability management is exporting a Qualys report and emailing it to engineering, this isn't for you. If you want to architect an automation-first vulnerability engine at global scale and be the technical authority behind it, keep reading.

Why Deriv

Deriv protects millions of global traders across distributed platforms and cloud environments. Vulnerability Management is a core defensive layer here, not an afterthought bolted onto compliance - and this role is designed to transform it into a measurable, automation-driven, intelligence-led capability with direct impact on enterprise risk reduction.

What You’ll Do

• Own the full vulnerability lifecycle: discovery, enrichment, prioritization, remediation, validation, and executive reporting
• Lead the operation and optimization of Qualys VMDR (Cloud Agents, SCA, PCI, dashboards, tagging, scan profiles) across AWS, GCP, Azure, Kubernetes and container workloads, endpoints (macOS, Windows, Linux), and office/network infrastructure
• Implement risk-based prioritization using CVSS, EPSS, CISA KEV, exploit intelligence, and asset criticality, and design sustainable exception management and risk acceptance governance
• Define and enforce remediation SLAs across engineering and IT, and reduce exposure windows (MTTR) and aging vulnerabilities quarter over quarter
• Correlate vulnerability findings with CSPM insights, IAM exposure, and threat intelligence to prioritize exploitable and externally exposed assets
• Strengthen integration between vulnerability data, SIEM, EDR, and cloud-native security controls, and support hardening aligned with CIS, NIST, ISO 27001, PCI-DSS, and DORA
• Design automated workflows for vulnerability intake, ticket creation, assignment, tracking, and remediation validation across scanning platforms, workflow tools, and internal security systems
• Use AI to enrich vulnerability context (exploitability, clustering, attack path, asset importance) and implement secure automated patching where technically validated and risk-appropriate
• Act as the bridge between Global Security Operations and local IT/Engineering, aligning vulnerability data with detection engineering and blue team strategy
• Serve as the technical authority for Vulnerability Management in Cyberjaya, mentoring analysts in risk-based triage and exploit analysis, and representing the function during audits and architecture reviews
  
  
  

Who You Are

• 8-12+ years of cybersecurity experience with deep specialization in vulnerability management
• Expert-level experience with Qualys VMDR (or equivalent: Tenable, Rapid7)
• Strong understanding of exploit intelligence, risk scoring models, and vulnerability lifecycle governance
• Hands-on experience across cloud security (AWS, GCP, Azure), CSPM integrations, endpoint patching and configuration management, and SIEM/EDR correlation
• Strong automation capability: Python, Bash, API integrations, workflow automation
• Experience implementing AI-assisted prioritization or remediation workflows
• Proven ability to build dashboards and KPIs that influence executive decisions
• Experience operating in regulated environments (ISO 27001, GDPR, PCI-DSS, DORA)
• Strong communicator who can translate technical exposure into business risk
  
  
  

The Honest Reality

This is a hands-on leadership role for someone who builds systems, not just processes. You'll raise findings and SLA breaches that aren't always welcome, and you'll be accountable for exposure windows in a regulated environment where a slipped patch cycle is a real finding, not a rounding error.

But you'll get high ownership and strategic influence within a global fintech security organization, the room to architect automation-first vulnerability management at scale, and direct impact on enterprise risk reduction alongside competitive compensation and a long-term leadership growth path.

If you want to run scans and forward reports, this isn't it. If you want to build the vulnerability engine that makes exploitable exposure the exception instead of the norm, it might be.

---