Vulnerability Engineer

Domino's Security team safeguards a platform trusted by some of the most regulated organizations in the world, across financial services, pharma, government, and defense. Vulnerability Management is where that trust gets tested day to day: finding, triaging, and closing out risk across our OS, container, and dependency surface, and giving customers a clear, defensible answer when they ask how exposed they are. This role joins that function as it scales, working closely with our Staff Security Engineer to turn a fast-growing vulnerability workload into faster, more consistent risk assessments.

Responsibilities

Faster, more consistent Vulnerability Risk Assessments. You'll own first-pass CVSS scoring and exploitability analysis, closing the SLA gap between finding and answer; Validated, trustworthy triage. You'll reproduce and confirm customer-reported and pen-test findings before they reach Engineering, so fix priority reflects real exploitability, not just scanner severity; Reliable scanning pipelines. You'll keep SAST/DAST and vulnerability scanning automations running, troubleshooting failures and tuning configs so the data everyone relies on stays clean; Real partnership with Engineering. You'll build or run PoC exploits on select CVEs, bringing validated risk, not just findings, into prioritization conversations; More capacity for the function. You'll free up our Staff Security Engineer to focus on program-level improvement instead of carrying all of vulnerability management's day-to-day load

Requirements

Hands-on experience managing vulnerabilities for a large SaaS product, across OS, container, and dependency exposure; A track record triaging and tracking CVEs for a SaaS or containerized product: reading scan reports, prioritizing by severity, and following through to resolution; Experience reproducing and validating reported vulnerabilities, whether from customer disclosures or pen test findings, not just logging them; Time spent with vulnerability scanning tools such as Prisma Cloud/Twistlock, JFrog, or Trivy, including reconciling findings across tools; Comfort building or maintaining SAST/DAST pipeline automation, and triaging what the scans turn up; Experience partnering with Engineering to get fixes prioritized and shipped, not just reported; Background in a highly regulated environment or modern software company, ideally one that moves at startup or scale-up speed; Strong scripting ability, Python preferred; Working knowledge of CVSS v3.1/v4.0 scoring and the judgment to assess risk, not just report it; Exploit development or PoC skills to validate real-world exploitability of CVEs, using tools like Burp Suite; Familiarity with OWASP Top 10 and testing methodology; Working knowledge of containers and Kubernetes, plus core Linux, AWS, and networking fundamentals; Basic understanding of authentication/authorization concepts (tokens, session handling, auth bypass patterns) and API security fundamentals; Basic threat modeling: thinking in attack paths, not just isolated severity scores; Clear communication, comfortable navigating risk conversations with Engineering and customers, including drafting risk statements a non-technical audience will actually read; Comfort operating with ambiguity, since not every finding arrives with a clean severity or fix path

Nice to have

OSWA, OSWE, or a similar offensive security certification (e.g. GWAPT, GPEN); Familiarity with Airflow and Snowflake