Senior Engineer, Exposure & Vulnerability Management
Clinical-stage TechBio company using an AI-native platform, automated experiments, and proprietary biological and chemical data to discover and develop medicines.
Funding history
About Recursion
Recursion Pharmaceuticals, Inc. is a public clinical-stage TechBio company headquartered in Salt Lake City, Utah. Its Recursion OS integrates biology, chemistry, clinical development, multimodal data, and purpose-built AI models.
Skills
Candidate Availability
Required and preferred rules are kept separate and reflect the wording in the original posting.
About the Role
You'll help shift from periodic scans to continuous, risk-driven exposure management. You'll design and deploy multi-agent systems that take exposures from discovery to verified closure with approval gates, audit trails and rollback. You'll build prioritization engines based on reachability, attack paths, business criticality and live exploit intelligence, automate verification to cut alert noise, and drive the CTEM strategy. You'll architect cloud-native discovery and remediation workflows integrated with ticketing and CI/CD, partner with Engineering and IT on secure-by-default practices, define KPIs, KCIs and KRIs, and support compliance such as SOC2.
Requirements
- Bachelor's or Master's degree in Computer Science, Information Security, or related field, or equivalent practical experience
- 7+ years of experience in vulnerability management, exposure management, or related security domains, including leading large-scale programs
- Deep understanding of security principles and turning vulnerability data into prioritized, verified remediation
- Hands-on experience building or deploying AI/LLM-based agents or multi-agent systems
- Working knowledge of approval workflows, audit logging and rollback controls for automated remediation
- Proficiency in programming languages such as Python, Go, Java and strong scripting skills
- Expert-level experience with vulnerability and exposure management platforms (Tenable, Qualys, Rapid7) and CTEM, attack surface management and attack-path analysis tooling
- Strong command of risk-based prioritization: CVSS, EPSS, CISA KEV, reachability analysis, threat intelligence
- Experience with AWS, Azure, GCP, container and Kubernetes security, and Infrastructure-as-Code (Terraform, CloudFormation)
- Experience with CI/CD pipelines, SCA/SAST tooling and software supply chain security including SBOMs
- Knowledge of UNIX/Linux, macOS, Windows, networking and database management systems
- Experience with risk management and compliance (SOC2, GxP)
- Security certifications such as CISSP, OSCP, GWAPT highly desirable
Responsibilities
- Design and deploy multi-agent systems that take exposures from discovery to closure with approval gates, audit trails and rollback
- Build prioritization engines ranking exposures on reachability, attack-path context, business criticality and live exploit intelligence
- Automate verification to separate theoretical flaws from actively exploitable conditions
- Drive the Continuous Threat Exposure Management (CTEM) strategy
- Assess the current exposure and vulnerability management program and revamp the strategy to support zero-trust security
- Architect cloud-native discovery, asset-inventory and remediation workflows integrated with ticketing, CI/CD and configuration management
- Partner with Engineering and IT to embed secure-by-default practices
- Define KPIs, KCIs and KRIs to measure control effectiveness
- Support regulatory compliance such as SOC2 by designing exposure and vulnerability controls
Benefits
- Annual bonus eligibility
- Equity compensation
- Comprehensive benefits package
- Remote position