Senior Security Engineer, Vulnerability & Exposure Management

Bridgewater Associates is a premier asset management firm dedicated to providing unique insights for sophisticated global institutional investors. The Senior Security Engineer will own and evolve the vulnerability and exposure management program, focusing on turning raw vulnerability data into risk-informed decisions to enhance the firm's security posture.

Responsibilities:

• Own Bridgewater’s vulnerability and exposure management program from detection through remediation and risk acceptance
• Define what “matters” from a vulnerability perspective and continuously refine that bar
• Validate vulnerabilities through technical analysis and, where appropriate, hands-on exploitation
• Apply a consistent risk methodology that accounts for asset criticality, data sensitivity, exposure (internal vs. external), exploitability, attacker prerequisites, and compensating controls
• Convert raw findings into prioritized, decision-relevant outputs aligned to enterprise risk
• Clearly articulate why a vulnerability is critical, acceptable, or noise
• Work directly with application and service owners to drive remediation of high-impact issues
• Build trust by providing clear logic, not mandates, and by respecting engineering realities
• Provide Detection & Response teams with context and prioritization guidance for zero-days and emerging threats
• Support response efforts without owning real-time containment or incident handling

Requirements:

• 10+ years of experience in security engineering, vulnerability management, incident response, or offensive security
• Demonstrated ownership of complex security programs as a senior individual contributor
• Deep understanding of vulnerability classes across infrastructure, cloud, and applications
• Strong grasp of exploitability, attack paths, privilege escalation, and real-world attacker tradecraft
• Experience validating vulnerabilities beyond scanner output
• Familiarity with cloud platforms, modern enterprise environments, and defense-in-depth controls
• Ability to engineer solutions that integrate data from multiple security and asset sources
• Exceptional ability to explain technical risk to engineers and non-security stakeholders
• Trusted partner mindset, credible, pragmatic, and outcome-focused
• Comfortable being accountable for decisions and program outcomes
• Prior experience in incident response, penetration testing, red teaming, or exploitation is strongly preferred