Key skills

Vulnerability ManagementOffensive Security Red TeamingOffensive Security Purple TeamingOffensive Security Penetration TestingCloud Infrastructure Security AWSCloud Infrastructure Security GCPCloud Infrastructure Security AzureContainer Security DockerContainer Security KubernetesPythonGoRustApplication Security Scanning SASTApplication Security Scanning DASTApplication Security Scanning SCACI/CD Security IntegrationCVSS and EPSSOWASP Top 10AI/LLM APIsAIGenerative AIGenAILLMAWSAzureGCPKubernetesDockerCI/CDOWASPPenetration Testing

About this role

Zocdoc is a digital health marketplace that helps patients find and book healthcare. The Senior Staff Security Engineer, Vulnerability Management will architect and scale an automated vulnerability detection and remediation ecosystem across cloud infrastructure, containers, and application code. The role focuses on AI-driven vulnerability analysis, offensive security validation, automated remediation, and continuous compliance.

Responsibilities:

Owning the technical roadmap for an automated, AI-driven vulnerability scanning platform across cloud infrastructure, container registries, operating systems, and application-layer software
Building context-engine models that correlate findings from SAST, DAST, SCA, and cloud posture tooling to determine true runtime exploitability
Implementing AI-assisted triage workflows that classify vulnerabilities, reduce false positives, and route validated issues to the right engineering teams
Leading targeted red teaming and collaborative purple teaming exercises to validate exploitable paths and strengthen runtime defenses
Partnering directly with Software Engineering and DevOps to build automated remediation pipelines, including dependency update pull requests and base-image patching workflows
Engineering security scanning guardrails into CI/CD pipelines and providing structured telemetry to support continuous compliance and executive risk visibility
Working with cutting-edge GenAI tools and technology to analyze findings, improve prioritization, and accelerate remediation workflows

Requirements:

- Meaningful experience in security engineering, vulnerability management, or software development, with at least 8 years focused on infrastructure, container platforms, and product security
- A proven track record of writing production-grade automation scripts and building custom security tooling at scale
- Hands-on experience planning or executing offensive security exercises, red teaming, purple teaming, or penetration testing
- Deep experience securing cloud infrastructure and containerized ecosystems using platforms such as AWS, GCP, or Azure, along with Docker and Kubernetes
- Advanced proficiency in Python, Go, or Rust to build automation, integrate scanner APIs, and orchestrate automated patching workflows
- Strong familiarity with adversarial frameworks, vulnerability scoring systems such as CVSS and EPSS, and common application and infrastructure attack vectors including the OWASP Top 10
- Experience integrating security scanners into CI/CD workflows and using AI or LLM APIs to analyze code or log data for rapid prioritization
- Required: the ability to integrate generative AI tools into daily workflows to automate tasks, foster innovation, and maximize productivity
- Advanced security certifications such as OSCE, OSCP, GXPN, CISSP, or equivalent practical engineering experience are highly valued