Vulnerability & Attack Surface Management Analyst II

OpenLoop is a telehealth support company whose mission is to bring care anywhere by powering telehealth solutions at scale. The Security Operations team protects patient data, clinical operations, and the systems partners build on; OpenLoop handles PHI and is subject to HIPAA. The Vulnerability & Attack Surface Management Analyst II reports to the Director of Information Security, is the first person dedicated to vulnerability management and attack surface management at OpenLoop, and will help build a program that has a direction already set. The role focuses on operational exposure and remediation, not incident response, GRC, or tool evaluation.

Responsibilities

Run the vulnerability lifecycle day to day (discovery, validation, prioritization, remediation tracking, verification, and reporting) across cloud workloads, containers, code repositories, and endpoints; Prioritize by actual risk using and improving a risk model that weighs internet exposure, exploitability (CISA KEV, EPSS), asset criticality, and data sensitivity; Build a reliable asset inventory combining cloud, endpoint, and SaaS inventory with a named owner for every asset that matters; Run external attack surface discovery on a set schedule; Drive remediation through Engineering, IT, and Platform teams, own fixes through verification; Fix problems at the source by rolling out hardened base images and dependency baselines, and automate repetitive work by connecting scanner and CNAPP APIs to ticketing and reporting; Own web application security by running dynamic scans, working fixes through application teams, and tracking mitigated versus fixed issues; Set up security checks for the new internal application publishing platform, including inventory and scanning before go-live; Manage vulnerability disclosure and bug bounty intake, validating reports and driving verified fixes; Use AI tools to triage findings, correlate data, draft remediation guidance, and produce reports while protecting sensitive data; Track and report metrics such as mean time to remediate, backlog burn-down, and SLA coverge, and prepare evidence for client, partner, and auditor requests in a HIPAA-regulated environment

Requirements

3 to 6 years in security, with significant hands-on experience in vulnerability management, attack surface management, or cloud security posture management; Hands-on experience running and tuning a vulnerability scanning or CNAPP platform; Experience prioritizing a large set of findings with a risk-based model, and the ability to explain how those calls were made; Working knowledge of CVSS, EPSS, and the CISA KEV catalog, and a view on how to use them together; Cloud security fundamentals in at least one major provider (GCP or AWS preferred), including workloads, identity, and network exposure; Experience with container and image vulnerabilities and dependency (SCA) findings in code repositories; Comfort starting with an incomplete inventory; Experience working directly with engineering teams to get fixes shipped; Scripting skills (Python, PowerShell, or similar) sufficient to query APIs and automate reporting; Regular, hands-on use of AI tools (Claude, ChatGPT, GitHub Copilot, or similar) in security work, with specific examples and judgment about sharing PHI, credentials, or sensitive data; Strong writing skills for engineer-actionable tickets and executive risk summaries

Nice to have

Experience with Wiz; Orca, Prisma Cloud, Defender for Cloud, or Lacework; CrowdStrike Falcon Exposure Management or Spotlight; Tenable, Qualys, or Rapid7 for non-cloud assets; External ASM tools and recon methods (DNS, certificate transparency, subdomain and shadow IT discovery); CAASM and inventory platforms such as Axonius or runZero; SaaS discovery tools; DAST and edge/WAF platforms (Invicti, Burp Suite, Cloudflare, Akamai); Vulnerability disclosure or bug bounty program experience (HackerOne, Bugcrowd); Hardened or minimal base images (Chainguard, distroless, or in-house golden images); Kubernetes and container security at scale (GKE, EKS); PaaS/edge hosting security (Vercel, Netlify, Cloudflare Pages); SBOMs and software supply chain security; Automation connecting scanner APIs to Jira, Slack, or reporting pipelines; Healthcare, fintech, or other regulated industry experience; HIPAA, HITRUST, or SOC 2 work, especially providing vulnerability management evidence to auditors and clients; Certifications such as GCLD, GCPN, GWEB, GSEC, AWS or GCP security specialty, OSCP, or equivalent experience

Benefits

Competitive compensation; Medical, Dental & Vision; Flexible Spending / Health Savings Accounts; Generous PTO and hybrid-work flexibility; 401(k) with Company Match; Life Insurance, Pet Insurance, and more