{"id":3634717,"url":"https://alion.io/job/relativity-advanced-security-engineer-exposure-management","title":"Advanced Security Engineer - Exposure Management","company":{"id":2576,"name":"Relativity","domain":"relativity.com","url":"https://alion.io/company/relativity","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":75,"open_postings":3,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":49,"computed_at":"2026-11-04T06:34:25Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":104000,"max":156000,"currency":"USD","period":"year","gross":null,"usd_annual":156000},"salary_estimate":null,"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CIS Benchmarks","optional":false},{"name":"CVSS","optional":false},{"name":"EPSS","optional":false},{"name":"KEV","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Threat Modeling","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"FedRAMP","optional":true},{"name":"GCP","optional":true},{"name":"ISO 27001","optional":true},{"name":"SIEM","optional":true},{"name":"SOC 2","optional":true}],"status":"live","first_seen_at":"2026-11-02T20:50:47Z","employer_posted_date":"2026-11-02","last_verified_at":"2026-11-04T06:03:30Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Posting Type\nHybrid/Remote\nJob Overview\nThe Advanced Security Engineer is a technically deep, hands-on practitioner who strengthens the organization’s Exposure Management capability. This role identifies and contextualizes vulnerabilities, misconfigurations, unmanaged assets, and container and API posture risks across the technology estate; correlates findings with asset criticality, exploitability, compensating controls, internet exposure, and threat intelligence; and translates them into a prioritized, continuously updated view of the exposures that matter most. Working closely with engineering and department leaders, Governance Risk Intelligence, Product Security Enablement, Adaptive Security, the Purple Team, Threat Detection & Response, and application and service owners, this engineer improves discovery and context coverage, makes residual risk and exposure aging visible, and coordinates reduction campaigns that help owning teams act on the highest-priority exposures. The role drives prioritization, reporting, and remediation follow-through while leaving risk-acceptance decisions, policy setting, and remediation execution with the accountable teams.Job Description and Requirements\nExposure & Attack Surface Discovery\nOperate and optimize exposure and external attack-surface discovery capabilities to identify internet-facing, unmanaged, shadow, and newly introduced assets across the technology estate.\nReconcile discovery results with authoritative asset inventories and ownership data, investigate coverage gaps, and improve attribution of assets to the responsible application, service, or department.\nDevelop repeatable workflows and automation that reduce discovery latency and increase coverage, data quality, and visibility across relevant asset classes.\nVulnerability & Misconfiguration Prioritization\nAnalyze vulnerabilities and misconfigurations from exposure management and partner-team data sources, correlating findings with exploitability, asset criticality, internet exposure, compensating controls, and available threat intelligence.\nDesign, tune, and document contextual prioritization logic that moves decision-making beyond raw severity scores and produces a defensible, risk-ranked exposure backlog.\nPerform detailed exposure analysis for high-impact vulnerabilities, zero-days, and material misconfigurations, and communicate why an exposure matters to technical and non-technical stakeholders.\nPartner with the Purple Team and other security functions to validate prioritization assumptions and improve correlation between top-priority exposures and confirmed exploitability.\nContainer & API Runtime Posture\nMaintain an accurate inventory and standing risk view of live containers and APIs, including running-image risk, workload ownership, API posture, and relevant production context.\nCorrelate build- and deployment-time findings received from Adaptive Security with production runtime context to determine whether identified risks remain relevant once workloads are live.\nIdentify systemic container and API posture issues and develop prioritized remediation campaigns for application- and service-owning teams.\nThreat Intelligence Integration\nIntegrate external and internal threat intelligence into exposure scoring and prioritization, including active exploitation, adversary behavior, and emerging-vulnerability signals.\nMaintain awareness of changes in the threat landscape and assess their relevance to the organization’s exposed technologies, assets, containers, and APIs.\nProduce timely, actionable notifications when new intelligence materially changes the likelihood or priority of an existing exposure.\nResidual Risk Visibility & Reporting\nBuild and maintain dashboards, reporting, and data pipelines that show residual exposure risk by department, asset class, severity tier, ownership, and age.\nDefine and monitor measures such as discovery coverage, context coverage, exposure aging, reduction rate, and residual-risk trend; investigate data-quality or performance issues that affect reporting trustworthiness.\nTranslate complex exposure data into clear technical findings, trends, and recommended actions for engineering leadership, department leaders, Governance Risk Intelligence, and service-owning teams.\nExposure Reduction Coordination\nTrack high-priority exposures against expected remediation timelines, identify aging and overdue items, and coordinate follow-through with accountable application- and service-owning teams.\nPlan and run targeted exposure-reduction campaigns, establish measurable outcomes, and report progress, blockers, and residual risk to relevant stakeholders.\nRoute exposures requiring risk-acceptance guidance to the owning team and Governance Risk Intelligence, and route findings requiring manual review, threat modeling, or adversary validation to the appropriate security function.\nProvide technical guidance and prioritization context without assuming ownership of risk acceptance, policy decisions, or remediation execution.\nMinimum Qualifications:\n2-6 years of hands-on experience in vulnerability management, exposure management, attack surface management, cloud security, or a related security engineering discipline.\nHands-on experience with vulnerability scanning, exposure management, or attack surface management platforms and the analysis of vulnerabilities, misconfigurations, unmanaged assets, and security posture findings.\nExperience prioritizing exposures using factors such as exploitability, asset criticality, internet exposure, threat intelligence, compensating controls, and business context, not severity scores alone.\nWorking knowledge of common enterprise and cloud technologies, including operating systems, networks, containers, APIs, and at least one major cloud platform.\nFamiliarity with vulnerability and security frameworks and sources such as CVSS, CISA KEV, EPSS, NIST, MITRE ATT&CK, and CIS benchmarks.\nProficiency in at least one scripting or automation language, such as Python, Bash, or PowerShell, used to integrate security data, automate analysis, or improve exposure-management workflows.\nAbility to investigate complex exposure data, identify systemic risk patterns, and clearly communicate prioritized findings and recommended actions to technical and non-technical stakeholders.\nPreferred Qualifications:\nBachelor’s degree in Computer Science, Cybersecurity, Information Security, or a related field, or equivalent practical experience.\nHands-on experience assessing exposure across multi-cloud or cloud-native environments.\nExperience with enterprise vulnerability management, exposure management, attack-surface management, or adjacent platforms.\nFamiliarity with AI-enabled SecOps (e.g., ML-based risk prioritization, or AI-assisted workflows)\nBasic knowledge of common cloud environments such as AWS, Azure, or GCP.\nExperience developing dashboards, metrics, or data pipelines.\nExperience supporting compliance and audit requirements (SOC 2, ISO 27001, FedRAMP) from a technical control perspective.\nRelevant certifications such as CC, SEC+, CySA+, or equivalent\nRelativity is committed to competitive, fair, and equitable compensation practices.\nThis position is eligible for total compensation which includes a competitive base salary, an annual performance bonus, and long-term incentives.\nThe expected salary range for this role is betweenfollowing values:\n$104,000 and $156,000The final offered salary will be based on several factors, including but not limited to the candidate's depth of experience, skill set, qualifications, and internal pay equity. Hiring at the top end of the range would not be typical, to allow for future meaningful salary growth in this position.\nRequired Skills:\nEndpoint Security, Network Security, Penetration Testing, Security Architecture Design, Security Automation, Security Information, Security Information and Event Management (SIEM), Security Operations, Threat Modeling, Vulnerability Management","description_format":"text","description_chars":7987,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Document Management","Legal AI","Legal Software"],"lifecycle":[{"event":"open","at":"2026-11-02T20:50:47Z"}],"visa":[],"liveness":{"score":99,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.993,"p_room":1,"age_days":1,"expected_fill_days":49,"reasons":["conf:0","urgency","velocity","win:early","comp:junior"],"computed_at":"2026-11-04T06:34:25Z"},"pay":{"stated_usd_annual":156000,"is_top_pay":true},"html_url":"https://alion.io/job/relativity-advanced-security-engineer-exposure-management","json_url":"https://alion.io/job/relativity-advanced-security-engineer-exposure-management.json","meta":{"generated_at":"2026-11-04T07:13:33Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":11335,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-05T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2576},"rest":"https://alion.io/mcp/rest/get_company?id=2576"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Frelativity-advanced-security-engineer-exposure-management"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Frelativity-advanced-security-engineer-exposure-management"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Frelativity-advanced-security-engineer-exposure-management"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/relativity-advanced-security-engineer-exposure-management\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Frelativity-advanced-security-engineer-exposure-management"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3634717}},{"tool":"search_jobs","arguments":{"company":"relativity.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3634717},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}