Cybersecurity Engineer - Vulnerability Management

📋 Job Overview

We're looking for a Cybersecurity Engineer to help us mature our vulnerability management program. You'll join our Cybersecurity team, a skilled group of programmers and security experts dedicated to keeping the firm safe.

🏢 About Jane Street

Jane Street is a quantitative trading firm that values skilled programmers and security experts.

🎯 The Role

Vulnerability management is the focus of this role, but it doesn't tell the whole story—we want a well-rounded engineer whose knowledge spans the different facets of cybersecurity, because that broader perspective is what lets you reason well about real risk and where to spend effort. This is a hands-on, build-heavy role. We want someone with a strong technical foundation who isn't afraid to build something themselves, who has good judgment about what actually matters, and who can explain the \"why\" behind a risk and its mitigation.

✅ Key Responsibilities

• Supporting and improving the vulnerability management lifecycle end to end, from discovery and validation through triage, assignment, remediation tracking, and verification
• Reviewing new findings from automated scanning tools, threat intel, and security advisories, then prioritizing based on real exploitability and exposure rather than severity score alone
• Validating and deduplicating findings across sources, confirming whether an affected product or component is actually present, and routing work to the team that owns the fix
• Measuring scanning coverage and data quality and knowing what isn't being scanned, where scans are stale, and where authentication is failing
• Driving automation across vulnerability management tooling and processes
• Broadening scanning coverage across asset classes, including evaluating and migrating scanning platforms as needed
• Bringing software inventory and SBOM data into the picture so we can answer where a vulnerable component is used across our software
• Building dashboards and metrics that measure coverage, SLAs, and progress

📌 Required Qualifications

• You automate rather than do things by hand, keep your code and configs in version control by default, work comfortably under code review, and care about leaving things maintainable
• You’re comfortable working with data, querying and shaping it, and building and debugging the data pipelines and integrations that stitch messy, inconsistent inputs into something dependable
• You have hands-on vulnerability management experience in a substantial environment, including experience with an automated scanning platform such as Rapid7, Tenable, or Qualys
• You’re a measured responder who reasons about trade-offs and context, understands threat modeling, and knows not every finding deserves the same urgency
• You follow cybersecurity developments and can tell the difference between an interesting hack and what matters day-to-day
• You understand and practice good personal cybersecurity hygiene, and can talk to others about it
• You’re a clear communicator across audiences, who writes things down so others can follow
• You have a positive and collaborative attitude; You understand that a key component of cybersecurity is bringing others along with you on the journey