Security Controls Engineer - Vulnerability management

Gen is a global company dedicated to powering Digital Freedom through its trusted consumer brands including Norton, Avast, LifeLock, MoneyLion and more. We're looking for an independent, driven security professional who thrives at the intersection of security, DevOps, and delivery. In this role, you will translate legal and security framework requirements into clear, actionable vulnerability management and remediation programs that operate across multiple Security and DevOps teams. You’ll help design, operationalize, and continually improve our vulnerability management lifecycle, from identification and triage through prioritization and remediation to validation and reporting. This includes secure development practices within regulatory frameworks guiding vulnerability handling, coordinated disclosure, SBOM transparency, patch management, and post-deployment monitoring. You will track, report, and escalate progress, risks, and dependencies, partnering closely with a Senior Project Manager and reporting to senior leadership.

Responsibilities

Translate legal and security framework requirements into clear, actionable vulnerability management and remediation programs that operate across multiple Security and DevOps teams; Help design, operationalize, and continually improve the vulnerability management lifecycle, from identification and triage through prioritization and remediation to validation and reporting; Include secure development practices within regulatory frameworks guiding vulnerability handling, coordinated disclosure, SBOM transparency, patch management, and post-deployment monitoring; Track, report, and escalate progress, risks, and dependencies, partnering closely with a Senior Project Manager and reporting to senior leadership

Requirements

Practical exposure or experience (typically 3–5 years) in vulnerability management, security engineering, or security program delivery in a cloud/software environment; Demonstrated ability to work independently and drive outcomes across multiple teams; Working understanding of regulatory security requirements and demonstrated experience with common frameworks/regulations implementation (e.g., ISO 27001, NIS2, SOC 2, GDPR, PCI DSS); Strong translation skills: turn policy and control language into developer-ready user stories, acceptance criteria, remediation tasks, and runbooks; Hands-on experience using work tracking tools (Jira, Azure DevOps, etc.) and crafting status reports/dashboards for leadership; Strong communication skills: comfortable analyzing vulnerability trends, including ageing, patch latency, and systemic root causes, supported by concise writing ability, clear meeting facilitation, and demonstrated experience with stakeholder alignment; Understanding of modern SDLC/DevOps practices (CI/CD, IaC, pipelines, change management); Experience in cloud environments (AWS/Azure/GCP), including shared responsibility and guardrail patterns

Nice to have

Wry sense of humor

Benefits

Flexible working options; Generous time off; Competitive benefits; Diverse and inclusive environment; Well-being programs