Security Specialist, Vulnerability Management (US - Remote)

AXON Networks delivers a robust AI-driven, analytics-based orchestration platform and a wide portfolio of next-gen high-speed routers that leverage the newest Wi-Fi technologies. Together, these technologies give ISPs the ability to manage and troubleshoot their networks in real time, and to deliver an outstanding customer experience.

AXON Networks is a trusted strategic partner for its customers, helping them evaluate their current technologies and business models, and creating and executing strategies that enable them to innovate faster, accelerate their digital transformations, and strengthen their relationships with consumers.

AXON Networks is headquartered in Irvine, CA USA with Asia HQ in Singapore and also operating in Denmark, Spain and Vietnam.

The Security Specialist, Vulnerability Management will establish and operate a risk-based vulnerability management capability across the company’s cloud platform, applications, Kubernetes and container environments, network infrastructure, software supply chain, and cloud-managed customer-premises equipment (CPE), including broadband gateways, routers, ONTs and connected-home devices. This is a hands-on security engineering role for someone who can distinguish a scanner finding from a vulnerability that is relevant and exploitable in the company’s actual environment.

The engineer will select and configure scanning approaches, validate findings, analyze CVEs, prioritize risk, coordinate remediation, verify closure and create the dashboards, evidence and operating standards needed for a repeatable program. The engineer will explain risk clearly to operational and engineering leaders and will not rely on severity scores alone.

Role mandate

• Establish authoritative visibility into vulnerabilities across cloud, application, container, Kubernetes, network, endpoint, dependency, firmwareand CPE asset classes.

• Determinewhether findings and CVEs apply to the versions, configurations, exposure pathsand controls actually presentin the environment.

• Prioritize remediation using technical severity, known exploitation, likelihood, reachability, asset criticality, customer impactand compensating controls.

• Create a durable operating model for intake, validation, assignment, service levels, exceptions, rescanning, closureand executive reporting.

• Partner with Engineering, DevOps, NOC, Support, Product and Compliance to reduce measurable exposure without disrupting reliable customer service.

Responsibilities

Scanning strategy and coverage

• Inventory the attack surface and define coverage for internet-facing and internal assets, cloud services, hosts, network devices, containers, Kubernetes clusters, applications, APIs, source code, third-party dependencies, images, infrastructure as code and supported CPE/firmware.

• Design, configure and maintainauthenticated and unauthenticated scans, agent-based assessments, cloud-native configuration checks, container and dependency scans, external attack-surface discoveryand targeted validation tests.

• Establish safe scan windows, credentials, rate limits, exclusionsand testing proceduresso scans do not destabilize production, customer environmentsor large CPE fleets.

• Evaluate, select and administer appropriate capabilities from platforms such as TenableNessus, Qualys, Rapid7, Wiz, Orca, Prisma Cloud, Snyk, Veracode, Checkmarx, Trivy, Grype, Nuclei or equivalent tools; integrate results rather than requiring one product to solve every use case.

• Measure coverage, scan health, credential success, stale assetsand blind spots; continuously improve asset-to-owner mapping and data quality.

Finding validation and CVE analysis

• Review new and existing scan findings and determinewhether each is a true positive, false positive, duplicate, accepted risk, mitigated condition or actionable vulnerability.

• Analyze CVE applicability using affected componentand version, package provenance, CPE or firmware bill of materials, runtime reachability, configuration, network exposure, privileges, exploit prerequisitesand existing controls.

• Reproduce or safely validatematerial findings when needed using vendor advisories, proof-of-concept analysis, logs, configuration evidence, package inspectionand non-production testing.