{"id":762812,"url":"https://alion.io/job/beyondtrust-vulnerability-manager","title":"Vulnerability Manager","company":{"id":5291,"name":"BeyondTrust","domain":"beyondtrust.com","url":"https://alion.io/company/beyondtrust","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":92,"open_postings":6,"ghost_share":0,"stale_share":0.333,"repost_share":0,"time_to_fill_p50_days":54,"computed_at":"2026-11-03T05:54:40Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":["Toronto, Canada","Canada"],"countries":["CA"],"hiring_countries":["US","CA"],"hiring_countries_total":2,"salary":null,"salary_estimate":{"min_usd":70000,"max_usd":142000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":9},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"BeyondTrust","optional":false},{"name":"CI/CD","optional":false},{"name":"CVSS","optional":false},{"name":"EPSS","optional":false},{"name":"FedRAMP","optional":false},{"name":"KEV","optional":false},{"name":"Kubernetes","optional":false},{"name":"Python","optional":false},{"name":"Azure","optional":true},{"name":"GCP","optional":true}],"status":"live","first_seen_at":"2026-09-11T18:52:29Z","employer_posted_date":"2026-09-11","last_verified_at":"2026-11-03T10:04:45Z","board_verified":true,"closed_at":null,"days_open":52,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":52},"description":"BeyondTrust is a place where you can bring your purpose to life through the work that you do, creating a safer world through our cybersecurity SaaS portfolio.\nOur culture of flexibility, trust, and continual learning means you will be recognized for your growth, and for the impact you make on our success. You will be surrounded by people who challenge, support, and inspire you to be the best version of yourself.\nThe Role\nThe Vulnerability Manager operates BeyondTrust's product vulnerability management program end to end. This is an operator role: you design the process, drive the automation that runs it, own the metrics, and are accountable for the answer when leadership asks what our open vulnerability risk is today. The primary focus is vulnerability management for FedRAMP 20x and standing up vulnerability management for new products as they ship. You partner closely with Security Engineering to define the integration requirements, partner with them closely through delivery, and own the operational outcome. The ideal candidate has designed a vulnerability management process inside a regulated environment, uses automation and AI to remove manual work rather than absorbing it, and can hold a remediation conversation with an engineering lead and an evidence conversation with an assessor on the same day. Fully remote, must be North America based.\nWhat You’ll Do\nDesign and operate the product vulnerability management process end to end: intake, triage, risk assessment, assignment, SLA tracking, exception handling, and closure verification.\nOwn vulnerability management for FedRAMP 20x, including continuous monitoring cadence, machine-readable evidence, Key Security Indicator reporting, and POA&M lifecycle from creation through closure.\nStand up vulnerability management for new products and services as they ship: define scan coverage, onboard them into the process, set SLAs, and establish reporting from first release.\nAssess and rank vulnerability risk using exploitability, exposure, asset criticality, and compensating controls rather than CVSS alone, and defend that ranking to engineers, executives, and assessors.\nDrive remediation with product engineering teams: assign ownership, agree timelines, escalate overdue Critical and High findings, and record risk acceptances as time-bound decisions with an expiry.\nAutomate the process wherever manual effort scales with finding volume, using scripting, workflow tooling, and AI-assisted analysis for triage, deduplication, enrichment, summarization, and evidence collection.\nDefine the requirements for platform integrations built by Security Engineering, covering scanners, ticketing, asset inventory, and dashboards. Partner with that team through delivery and validate the result against the operational need.\nOwn the program metrics: SLA attainment, mean time to remediate, vulnerability aging, backlog trend, scan and asset coverage, and exception volume. Report them on a fixed cadence to security and engineering leadership.\nMonitor the vulnerabilities that matter most. Maintain a current view of critical exposure across the product portfolio and serve as the authoritative answer to what is open, what it means, and when it closes.\nLead rapid response for actively exploited and zero-day vulnerabilities, including exposure assessment across the product fleet, mitigation tracking, and stakeholder communication.\nWhat You’ll Bring\n5+ years in vulnerability management, product security, or security operations, with direct ownership of a vulnerability management process rather than participation in one.\nDemonstrated experience designing and operating vulnerability management process in a regulated or audited environment, and sustaining it through assessment cycles.\nWorking knowledge of FedRAMP and NIST SP 800-53, specifically vulnerability scanning, flaw remediation, continuous monitoring, configuration management, and POA&M management.\nHands-on operation of enterprise vulnerability and exposure management platforms, cloud security posture tooling, container scanning, and software composition analysis.\nPractical automation skill: scripting in Python or equivalent, workflow and reporting tooling, and use of AI assistants to reduce manual triage and reporting effort. This role automates its own process; it does not build platform software.\nAbility to write clear technical requirements and partner with security engineering through design, delivery, and acceptance.\nStrong understanding of CVSS, CISA Known Exploited Vulnerabilities (KEV), EPSS, and risk-based prioritization, with the judgment to separate a high score from a real exposure.\nWorking knowledge of cloud services (AWS preferred), containers, Kubernetes, CI/CD, web applications, and APIs, sufficient to assess a finding and evaluate a proposed fix.\nAbility to drive remediation across engineering teams without direct authority.\nClear written and verbal communication with engineers, executives, auditors, and customers.\nNice To Have\nDirect experience supporting FedRAMP Moderate or High authorization and continuous monitoring, or FedRAMP 20x.\nExperience defining metrics and building reporting or dashboards for executive and audit audiences.\nExperience with SaaS, identity security, or privileged access management products.\nFamiliarity with agentic or AI-assisted security workflows.\nCloud security certifications (AWS, Azure, GCP), GIAC, CISSP, or equivalent.\nBetter Together\nDiversity. Inclusion. They’re more than just words for us. They are the guiding values of how we build our teams, cultivate leaders, and create a culture where people feel connected.\nWe take care of our employees so they can take care of our customers. Customers who come from all walks of life just like us. We hire incredible people from diverse backgrounds because when we are different together, we are stronger together.\nAbout Us\nBeyondTrust is the global identity security leader protecting Paths to Privilege™. Our identity-centric approach goes beyond securing privileges and access, empowering organizations with the most effective solution to manage the entire identity attack surface and neutralize threats, whether from external attacks or insiders.\nBeyondTrust is leading the charge in transforming identity security to prevent breaches and limit the blast radius of attacks, while creating a superior customer experience and operational efficiencies. We are trusted by 20,000 customers, including 75 of the Fortune 100, and our global ecosystem of partners.\nLearn more at www.beyondtrust.com.","description_format":"text","description_chars":6558,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"},{"name":"Canada","iso":"CA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Identity Management","Information Security"],"lifecycle":[{"event":"open","at":"2026-09-11T18:59:43Z"}],"visa":[],"liveness":{"score":60,"band":"ok","label":"Likely open","p_open":1,"p_active":0.795,"p_room":0.75,"age_days":52,"expected_fill_days":54,"reasons":["conf:0","velocity","win:late"],"computed_at":"2026-11-03T05:54:40Z"},"pay":null,"html_url":"https://alion.io/job/beyondtrust-vulnerability-manager","json_url":"https://alion.io/job/beyondtrust-vulnerability-manager.json","meta":{"generated_at":"2026-11-03T12:02:43Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":16591,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-04T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5291},"rest":"https://alion.io/mcp/rest/get_company?id=5291"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fbeyondtrust-vulnerability-manager"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fbeyondtrust-vulnerability-manager"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fbeyondtrust-vulnerability-manager"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/beyondtrust-vulnerability-manager\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fbeyondtrust-vulnerability-manager"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":762812}},{"tool":"search_jobs","arguments":{"company":"beyondtrust.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":762812},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}