{"id":1706718,"url":"https://alion.io/job/amerisourcebergen-engineer-iii-vulnerability-management","title":"Engineer III, Vulnerability Management","company":{"id":2623,"name":"AmerisourceBergen","domain":"amerisourcebergen.com","url":"https://alion.io/company/amerisourcebergen","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Industrial Engineering","role_family":"Industrial Engineering","seniority":"middle","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"inferred_payroll_markers","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":65000,"max_usd":127000,"period":"year","method":"global_role_seniority_cell","sample_n":4414},"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CVSS","optional":false},{"name":"EPSS","optional":false},{"name":"GDPR","optional":false},{"name":"HIPAA","optional":false},{"name":"ISO 27001","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"NIST 800-53","optional":false},{"name":"NIST CSF","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PCI DSS","optional":false},{"name":"Power BI","optional":false},{"name":"Qualys Cloud Platform","optional":false},{"name":"SLI/SLO/SLA","optional":false},{"name":"SQL","optional":false},{"name":"Wiz","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"GCP","optional":true},{"name":"Jira","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true},{"name":"ServiceNow","optional":true},{"name":"SIEM","optional":true}],"status":"live","first_seen_at":"2026-10-02T12:27:32Z","employer_posted_date":null,"last_verified_at":"2026-10-02T12:27:32Z","board_verified":false,"closed_at":null,"days_open":10,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":10},"description":"Our team members are at the heart of everything we do. At Cencora, we are united in our responsibility to create healthier futures, and every person here is essential to us being able to deliver on that purpose. If you want to make a difference at the center of health, come join our innovative company and help us improve the lives of people and animals everywhere. Apply today!\nJob DetailsJob SummaryThe Engineer III - Vulnerability Management is a senior technical contributor responsible for identifying, analyzing, prioritizing, reporting, and driving remediation of vulnerabilities and posture findings across enterprise environments. This role supports and helps mature a unified, risk-based Vulnerability and Posture Management capability spanning infrastructure, endpoints, cloud workloads, network devices, applications, SaaS platforms, external attack surface, and other critical assets. The Engineer III will help lead Continuous Threat Exposure Management (CTEM) activities, operate and optimize attack surface management and vulnerability management tools, and partner with technology, security, and business stakeholders to measurably reduce cyber risk.\nPrimary Responsibilities\nPerform advanced vulnerability analysis across infrastructure, cloud, endpoint, network, application, SaaS, and externally facing assets.\n\nLead and support Continuous Threat Exposure Management (CTEM) processes, including scoping, discovery, prioritization, validation, mobilization, and ongoing risk reduction activities.\n\nOperate and improve vulnerability management, attack surface management, external posture management, cloud posture and SaaS posture capabilities.\n\nAnalyze vulnerability and posture data from multiple sources, normalize findings, and develop actionable risk-based remediation priorities.\n\nAssess vulnerabilities using business context, asset criticality, exploitability, threat intelligence, exposure, compensating controls, and regulatory or compliance impact.\n\nDrive remediation and risk treatment efforts with infrastructure, cloud, network, application, endpoint, DevOps, and business technology teams.\n\nLead emerging vulnerability and critical exposure response activities, including impact analysis, stakeholder coordination, mitigation tracking, and executive-level status reporting.\n\nCreate and maintain dashboards, metrics, and reporting for vulnerability trends, remediation progress, SLA performance, exposure reduction, attack surface changes, and program maturity.\n\nSupport implementation and optimization of unified vulnerability management workflows, including ticketing, ownership assignment, exception handling, rescan validation, remediation automation, and governance routines.\n\nEvaluate and recommend improvements to scanning coverage, asset inventory quality, vulnerability data integrity, risk scoring, and stakeholder reporting.\n\nTranslate complex technical findings into clear remediation guidance for technical teams and concise risk summaries for leadership.\n\nContribute to security standards, procedures, playbooks, process documentation, and continuous improvement initiatives for the Vulnerability and Posture Management program.\n\nMentor junior engineers and analysts by providing technical guidance, quality review, and support for vulnerability triage and remediation governance.\n\nRequired Qualifications\nBachelor’s degree in Cybersecurity, Computer Science, Information Systems, Information Technology, Engineering, or a related field, or equivalent practical experience.\n\n7-10 years of combined experience in information technology, cybersecurity, systems administration, cloud operations, network security, application security, security engineering, or related disciplines.\n\nAt least 4 years of hands-on experience in vulnerability management, exposure management, attack surface management, configuration assurance, or a closely related cybersecurity function.\n\nAt least one active cybersecurity certification, such as CISSP, CISM, Security+, CySA+, GSEC, CCSK, CCSP, OSCP, GIAC certification, or another recognized security certification.\n\nStrong understanding of vulnerability lifecycle management, including discovery, validation, prioritization, remediation, exception handling, rescan validation, and reporting.\n\nExperience using vulnerability assessment or vulnerability management platforms such as Qualys, Tenable, Rapid7 InsightVM, Microsoft Defender Vulnerability Management, Wiz, Armis, or comparable tools.\n\nExperience with attack surface, posture, or exposure management capabilities such as CAASM, EASM, RBVM, CSPM, SSPM, external posture management, or security ratings platforms.\n\nAbility to interpret vulnerability findings, CVEs, CVSS, EPSS, threat intelligence, exploitability indicators, asset context, and compensating controls to prioritize risk.\n\nExperience working with enterprise asset data, CMDB data, ownership models, assignment groups, and business criticality attributes.\n\nStrong analytical skills with experience using Excel, Power BI, SQL, data lakes, reporting platforms, or other data analysis and visualization tools.\n\nWorking knowledge of common security frameworks and standards such as NIST CSF, NIST 800-53, ISO 27001, CIS Critical Security Controls, PCI DSS, HIPAA, GDPR, OWASP Top 10, SANS Top 25, and MITRE ATT&CK.\n\nExcellent written and verbal communication skills, with the ability to explain technical risk to both technical and non-technical audiences.\n\nDemonstrated ability to coordinate cross-functional remediation activities in a complex enterprise environment.\n\nPreferred Qualifications\nExperience helping build or mature a CTEM, exposure management, or unified risk-based vulnerability management program.\n\nExperience with vulnerability workflow automation, ServiceNow SecOps, Jira, SOAR, or similar remediation workflow platforms.\n\nExperience consolidating and normalizing vulnerability data across multiple source tools and integrating results into dashboards, remediation queues, or governance workflows.\n\nExperience with cloud security and cloud posture management across AWS, Azure, Google Cloud, or hybrid environments.\n\nExperience with external attack surface management, SaaS security posture management, configuration assurance, or third-party exposure management.\n\nExperience supporting regulatory, audit, customer assurance, or compliance reporting related to vulnerability and exposure management.\n\nFamiliarity with scripting or automation using Python, PowerShell, APIs, or query languages to improve reporting, remediation tracking, and data quality.\n\nAbility to influence without direct authority and lead cross-functional initiatives across technical teams, business stakeholders, and security leadership.\n\nTools and TechnologiesThe successful candidate should be comfortable working with a broad ecosystem of vulnerability, posture, exposure, and reporting technologies. Relevant tools may include vulnerability scanners, endpoint vulnerability platforms, cloud security posture tools, external attack surface management tools, SaaS posture tools, risk-based vulnerability management platforms, workflow automation solutions, SIEM or threat intelligence platforms, ServiceNow, Power BI, Excel, SQL, and data integration technologies.\nKey Competencies\nRisk-based decision making and prioritization\n\nStrong technical analysis and investigative discipline\n\nEnterprise stakeholder management and cross-functional coordination\n\nClear communication of technical risk and business impact\n\nOperational excellence, process improvement, and automation mindset\n\nData quality awareness and ability to reconcile conflicting tool outputs\n\nOwnership, accountability, and ability to lead initiatives with limited direction\n\nAbility to balance tactical remediation urgency with strategic program maturity\n\nSuccess Measures\nImproved visibility and coverage across enterprise assets, including cloud, endpoint, network, application, SaaS, and externally exposed environments.\n\nReduced critical and high-risk vulnerability exposure through effective prioritization, remediation governance, and stakeholder engagement.\n\nImproved mean time to remediate, vulnerability closure rate, and SLA adherence.\n\nIncreased adoption of risk-based vulnerability management and CTEM practices across security and technology teams.\n\nImproved quality, consistency, and usability of vulnerability reporting, dashboards, ownership mapping, and remediation workflows.\n\nDemonstrated progress in reducing attack surface risk and improving overall security posture.\n\nWhat Cencora offersWe provide compensation, benefits, and resources that enable a highly inclusive culture and support our team members’ ability to live with purpose every day. In addition to traditional offerings like medical, dental, and vision care, we also provide a comprehensive suite of benefits that focus on the physical, emotional, financial, and social aspects of wellness. This encompasses support for working families, which may include backup dependent care, adoption assistance, infertility coverage, family building support, behavioral health solutions, paid parental leave, and paid caregiver leave. To encourage your personal growth, we also offer a variety of training programs, professional development resources, and opportunities to participate in mentorship programs, employee resource groups, volunteer activities, and much more. For details, visit \nFull timeEqual Employment OpportunityCencora is committed to providing equal employment opportunity without regard to race, color, religion, sex, sexual orientation, gender identity, genetic information, national origin, age, disability, veteran status or membership in any other class protected by federal, state or local law.\nThe company’s continued success depends on the full and effective utilization of qualified individuals. Therefore, harassment is prohibited and all matters related to recruiting, training, compensation, benefits, promotions and transfers comply with equal opportunity principles and are non-discriminatory.\nCencora is committed to providing reasonable accommodations to individuals with disabilities during the employment process which are consistent with legal requirements. If you wish to request an accommodation while seeking employment, please call 888.692.2272 or email . We will make accommodation determinations on a request-by-request basis. Messages and emails regarding anything other than accommodations requests will not be returned\nAffiliated CompaniesAffiliated Companies: AmerisourceBergen Services CorporationOriginally posted on Himalayas","description_format":"text","description_chars":10604,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Parental leave","Professional development"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Endpoint Security","Information Security","Vulnerability Management","Pharmaceutical Distribution"],"lifecycle":[{"event":"open","at":"2026-10-02T15:04:10Z"}],"visa":[],"liveness":{"score":72,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.796,"p_room":0.9,"age_days":10,"expected_fill_days":27,"reasons":["seen:10","win:mid"],"computed_at":"2026-10-13T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/amerisourcebergen-engineer-iii-vulnerability-management","json_url":"https://alion.io/job/amerisourcebergen-engineer-iii-vulnerability-management.json","meta":{"generated_at":"2026-10-13T10:14:19Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":15634,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2623},"rest":"https://alion.io/mcp/rest/get_company?id=2623"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Famerisourcebergen-engineer-iii-vulnerability-management"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Famerisourcebergen-engineer-iii-vulnerability-management"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Famerisourcebergen-engineer-iii-vulnerability-management"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/amerisourcebergen-engineer-iii-vulnerability-management\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Famerisourcebergen-engineer-iii-vulnerability-management"}]}