{"id":123625,"url":"https://alion.io/job/zocdoc-senior-staff-security-engineer-vulnerability-management","title":"Senior Staff Security Engineer, Vulnerability Management","company":{"id":47075,"name":"Zocdoc","domain":"zocdoc.com","url":"https://alion.io/company/zocdoc","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":83,"open_postings":9,"ghost_share":0,"stale_share":0.667,"repost_share":0,"time_to_fill_p50_days":51,"computed_at":"2026-10-20T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"staff","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["New York, United States","United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":200000,"max":290000,"currency":"USD","period":"year","gross":null,"usd_annual":290000},"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"CVSS","optional":false},{"name":"Docker","optional":false},{"name":"EPSS","optional":false},{"name":"GCP","optional":false},{"name":"Kubernetes","optional":false},{"name":"LLM","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"Rust","optional":false}],"status":"live","first_seen_at":"2026-07-14T14:58:44Z","employer_posted_date":"2026-09-11","last_verified_at":"2026-10-20T10:55:57Z","board_verified":true,"closed_at":null,"days_open":97,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":97},"description":"Our Mission\n\nYou call. You wait. You call again. In every other part of your life, you book in seconds. In healthcare, you’re blocked. \nWe’re here to give power to the patient. \nFor nearly 20 years, we’ve built the leading healthcare marketplace - helping tens of millions of people find and book the care they need. Now, we’re going further: building our infrastructure beyond Zocdoc’s marketplace to power access to care wherever patients search, from provider websites and insurance directories to search engines, AI platforms, and more.\nHealthcare still lacks something every other major consumer industry takes for granted: a seamless way to go from seeking to getting. We don’t want to own the front door to care; there isn't one. We want to make sure all of those doors open when patients are knocking.\nFixing healthcare starts with fixing access to it. And we're still just getting started.\nYour Impact on our Mission\nZocdoc’s most important asset is our people and our platform. As a Senior Staff Engineer, Vulnerability Management, you’ll play a meaningful role in strengthening both by architecting and scaling our next-generation vulnerability detection and remediation ecosystem across Compliance, Security, and Engineering. In this role, you’ll help move our security posture from reactive firefighting to predictive, continuous risk reduction through intelligent automation, deeper full-stack visibility, and faster remediation across infrastructure, containers, and application code.\nYou’ll enjoy this role if you are…\nPersonally motivated by building secure, scalable systems that reduce real-world risk at scale.\nAutonomous, urgent, and creative, and you love turning noisy security findings into actionable engineering outcomes.\nHighly collaborative and energized by working across Security, Compliance, Engineering, and DevOps teams.\nPassionate about offensive security, adversarial validation, and understanding how theoretical vulnerabilities translate into operational exposure.\nA systems thinker who can connect infrastructure, application security, compliance, and automation into one cohesive program.\nThe kind of person who enjoys pairing deep technical judgment with practical execution and measurable impact.\nSerious about your work, but not about yourself.\nYour day to day is…\nOwning the technical roadmap for an automated, AI-driven vulnerability scanning platform across cloud infrastructure, container registries, operating systems, and application-layer software.\nBuilding context-engine models that correlate findings from SAST, DAST, SCA, and cloud posture tooling to determine true runtime exploitability.\nImplementing AI-assisted triage workflows that classify vulnerabilities, reduce false positives, and route validated issues to the right engineering teams.\nLeading targeted red teaming and collaborative purple teaming exercises to validate exploitable paths and strengthen runtime defenses.\nPartnering directly with Software Engineering and DevOps to build automated remediation pipelines, including dependency update pull requests and base-image patching workflows.\nEngineering security scanning guardrails into CI/CD pipelines and providing structured telemetry to support continuous compliance and executive risk visibility.\nWorking with cutting-edge GenAI tools and technology to analyze findings, improve prioritization, and accelerate remediation workflows.\nYou’ll be successful in this role if you have…\nMeaningful experience in security engineering, vulnerability management, or software development, with at least 8 years focused on infrastructure, container platforms, and product security.\nA proven track record of writing production-grade automation scripts and building custom security tooling at scale.\nHands-on experience planning or executing offensive security exercises, red teaming, purple teaming, or penetration testing.\nDeep experience securing cloud infrastructure and containerized ecosystems using platforms such as AWS, GCP, or Azure, along with Docker and Kubernetes.\nAdvanced proficiency in Python, Go, or Rust to build automation, integrate scanner APIs, and orchestrate automated patching workflows.\nStrong familiarity with adversarial frameworks, vulnerability scoring systems such as CVSS and EPSS, and common application and infrastructure attack vectors including the OWASP Top 10.\nExperience integrating security scanners into CI/CD workflows and using AI or LLM APIs to analyze code or log data for rapid prioritization.\nRequired: the ability to integrate generative AI tools into daily workflows to automate tasks, foster innovation, and maximize productivity.\nAdvanced security certifications such as OSCE, OSCP, GXPN, CISSP, or equivalent practical engineering experience are highly valued.\nBenefits:\nFlexible work environment\nUnlimited Vacation\n100% paid employee health benefit options (including medical, dental, and vision)\n401(k) with employer funded match\nCorporate wellness programs with Headspace and Peloton\nSabbatical leave (for employees with 5+ years of service)\nCompetitive paid parental leave and fertility/family planning reimbursement\nCell phone reimbursement\nEmployee Resource Groups and ZocClubs to promote shared community and belonging\nGreat Place to Work Certified\nZocdoc is committed to fair and equitable compensation practices. Salary ranges are determined through alignment with market data. Base salary offered is determined by a number of factors including the candidate’s experience, qualifications, and skills. Certain positions are also eligible for variable pay and/or equity.\nRemote Base Salary Range\n$200,000—$290,000 USD\nAbout us\n Zocdoc is the country’s leading digital health marketplace that helps patients easily find and book the care they need. Each month, millions of patients use our free service to find nearby, in-network providers, compare choices based on verified patient reviews, and instantly book in-person or video visits online. Providers participate in Zocdoc’s Marketplace to reach new patients to grow their practice, fill their last-minute openings, and deliver a better healthcare experience. Founded in 2007 with a mission to give power to the patient, our work each day in pursuit of that mission is guided by oursix core values. Zocdoc is a private company backed by some of the world’s leading investors, and we believe we’re still only scratching the surface of what we plan to accomplish. \nZocdoc is a mission-driven organization dedicated to building teams as diverse as the patients and providers we aim to serve. In the spirit of one of our core values - Together, Not Alone, we are a company that prides itself on being highly collaborative, and we believe that diverse perspectives, experiences and contributors make our community and our platform better. We’re an equal opportunity employer committed to providing employees with a work environment free of discrimination and harassment. Applicants are considered for employment regardless of race, color, ethnicity, ancestry, religion, national origin, gender, sex, gender identity, gender expression, sexual orientation, age, citizenship, marital or parental status, disability, veteran status, or any other class protected by applicable laws.\nJob Applicant Privacy Notice","description_format":"text","description_chars":7274,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Flexible schedule","Parental leave","Wellness"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Endpoint Security","Information Security","Vulnerability Management","Patient Access & Booking"],"lifecycle":[{"event":"open","at":"2026-07-14T14:58:44Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 17 · green card filings: 1","filings_12m":17,"filings_prev_12m":10,"green_card_filings_12m":1,"median_offered_wage_usd":223611,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":31,"band":"fade","label":"Fading","p_open":1,"p_active":0.87,"p_room":0.36,"age_days":97,"expected_fill_days":51,"reasons":["conf:3","velocity","win:tail","crowd:"],"computed_at":"2026-10-20T05:45:00Z"},"pay":{"stated_usd_annual":290000,"is_top_pay":true},"html_url":"https://alion.io/job/zocdoc-senior-staff-security-engineer-vulnerability-management","json_url":"https://alion.io/job/zocdoc-senior-staff-security-engineer-vulnerability-management.json","meta":{"generated_at":"2026-10-20T12:36:02Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":13869,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-21T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":47075},"rest":"https://alion.io/mcp/rest/get_company?id=47075"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fzocdoc-senior-staff-security-engineer-vulnerability-management"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fzocdoc-senior-staff-security-engineer-vulnerability-management"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fzocdoc-senior-staff-security-engineer-vulnerability-management"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/zocdoc-senior-staff-security-engineer-vulnerability-management\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fzocdoc-senior-staff-security-engineer-vulnerability-management"}]}