Threat & Vulnerability Management Security Engineer II

AmTrust Financial Services, Inc. helps reduce enterprise technology risk through a mature, continuously improving Vulnerability Management Program. In this onsite role in Cleveland, OH, you will help strengthen exposure visibility, drive remediation performance, and support risk governance across on-premises, cloud, and hybrid environments. The team emphasizes a diverse and inclusive culture where ideas are respected, with career advancement opportunities and recognition for excellence.

What You’ll Do

• Own and continuously evolve the enterprise Vulnerability Management Program across the IT environment.
• Manage the end-to-end vulnerability lifecycle: discovery, validation, risk prioritization, remediation tracking, exception management, verification, and reporting.
• Analyze threat actors, campaigns, industry trends, and emerging cyber risks to produce threat intelligence that informs vulnerability prioritization, exposure management, and security and business decisions.
• Operate and optimize vulnerability assessment technologies to maintain comprehensive asset coverage, accurate findings, and actionable risk visibility.
• Correlate and prioritize findings across vulnerability management security platforms, attack surface management solutions, and threat intelligence sources.
• Use risk-based prioritization methods incorporating CVSS, CISA Known Exploited Vulnerabilities (KEV), exploitability, asset criticality, exposure, and business impact.
• Partner with asset management and technology teams to improve asset inventory accuracy, security coverage, ownership attribution, and enterprise risk visibility.
• Design, develop, and maintain security automation capabilities that streamline vulnerability management and security operations, improving efficiency, consistency, data quality, and remediation outcomes while maintaining appropriate governance and oversight.
• Build and enhance integrations, workflows, and tooling across security platforms to automate repetitive tasks, improve visibility and reporting, and enable scalable, end-to-end security operations.
• Coordinate remediation efforts across infrastructure, application, cloud, network, and other technical teams in line with established service-level objectives and risk severity.
• Lead coordinated response activities for critical vulnerabilities, zero-day threats, and actively exploited CVEs, including rapid assessment, prioritization, remediation, and risk communication.
• Manage vulnerability exceptions, compensating controls, risk acceptance processes, and periodic exception reviews to ensure risks remain documented and governed.
• Develop and maintain vulnerability management policies, standards, procedures, runbooks, and reporting frameworks.
• Create executive and operational metrics to measure risk reduction, remediation performance, vulnerability trends, asset coverage, SLA adherence, exception exposure, and mean time to remediate (MTTR).
• Support audits, compliance assessments, and enterprise risk management through accurate documentation, reporting, and evidence collection.
• Monitor emerging vulnerabilities, exploitation trends, threat intelligence, and industry best practices to strengthen program effectiveness and risk-based prioritization.

What You Bring

• Bachelor’s degree in Computer Science, Information Technology, Computer Engineering, Cybersecurity, or a related field, or equivalent relevant professional experience.
• 3+ years of experience managing enterprise vulnerability management programs across on-premises, cloud, and hybrid environments.
• Hands-on experience with vulnerability management platforms (e.g., Tenable, Qualys, Rapid7, Microsoft Defender VM) and vulnerability assessment, validation, prioritization, and remediation practices.
• Strong understanding of vulnerability and threat intelligence frameworks, including CVE, CVSS, CISA KEV, exploit intelligence, attack surface management, and risk-based decision making.
• Experience securing modern technology environments, including Azure, AWS, GCP, cloud-native workloads, and containerized applications; relevant certifications such as CISSP, CySA+, GCVA, GSEC, GCSA, GCTI, or OSCP are preferred.

Benefits

• Medical & Dental Plans
• Life Insurance, including eligible spouses & children
• Health Care Flexible Spending
• Dependent Care
• 401k Savings Plans
• Paid Time Off

Technologies You May Work With

• Tenable, Qualys, Rapid7, Microsoft Defender VM
• CVE, CVSS, CISA Known Exploited Vulnerabilities (KEV)
• Attack surface management
• Azure, AWS, GCP
• Containerized applications
• CISSP, CySA+, GCVA, GSEC, GCSA, GCTI, OSCP

What AmTrust Offers: A competitive compensation package and excellent career advancement opportunities, along with a diverse and inclusive culture where employee ideas are appreciated and respected.