Vulnerability Management
Scanning is the easy part — the real discipline in vulnerability management is turning an overwhelming pile of CVEs into a prioritized, actually-getting-fixed list, and increasingly extending that same discipline out to the assets a company didn't even know it had exposed to the internet.
Vulnerability AssessmentVulnerability RemediationExposure ManagementPatch ManagementSecurity Testing
Vulnerability Management Analyst
You find the holes in the organization's attack surface before attackers do, then make sure someone actually closes them.
What it's about & how to get in
You run and tune vulnerability scanners (Tenable, Qualys, Rapid7 InsightVM), triage the flood of findings by real-world exploitability and business risk, and turn raw CVE lists into prioritized tickets that IT and dev teams can actually act on. Day to day means dashboards, SLA tracking, exception requests, and a lot of conversations convincing asset owners that 'critical' really means critical.
Most people land here from a help-desk, sysadmin, or SOC analyst background — it's one of the most common entry points into security operations. From here the typical paths are up into Vulnerability Management Engineer (building and automating the program) or sideways into penetration testing or GRC.
Where you can work
- In-house security teams at mid-size and large enterprises
- Managed security service providers (MSSPs) running VM-as-a-service for clients
- Financial services and healthcare organizations with heavy compliance scanning requirements
- Government and defense contractors running continuous ATO/RMF scanning
- Cloud-native companies embedding scanning into CI/CD pipelines
What it pays
Certifications that open doors
Where you can actually learn it
Vulnerability Management Engineer
You build and automate the vulnerability management program itself — the scanning infrastructure, the pipelines, the metrics — rather than just working the queue.
What it's about & how to get in
You own the VM tooling stack end to end: deploying and scaling scanners across cloud and on-prem, integrating findings into ticketing and CMDB systems via API, writing automation that auto-prioritizes and auto-assigns findings, and building the executive dashboards that show risk trending down (or up). You're as much a systems/software engineer as a security person.
This role is usually a promotion from Vulnerability Management Analyst or a lateral move from security automation/DevSecOps engineering. It sits next to Attack Surface Management and Exposure Management roles, which are really the same discipline extended beyond traditional scanning.
Where you can work
- Enterprise security engineering teams building internal VM platforms
- Cybersecurity vendors (Tenable, Qualys, Rapid7, Wiz) building or supporting the scanning products themselves
- Cloud-first companies integrating vulnerability scanning into CI/CD and IaC pipelines
- MSSPs building multi-tenant scanning automation
- Large regulated enterprises (banking, healthcare) with dedicated VM engineering teams separate from the analyst function
What it pays
Certifications that open doors
Where you can actually learn it
Vulnerability Researcher
You reverse-engineer software and hardware to find brand-new vulnerabilities before anyone else knows they exist.
What it's about & how to get in
You spend your time fuzzing binaries, reverse-engineering firmware or applications in IDA/Ghidra, chasing memory-corruption bugs, and writing up (and sometimes weaponizing, for research or red-team purposes) proof-of-concept exploits. This is deep, often solitary technical work — far more reverse engineering and exploit development than ticket triage.
People get here from penetration testing, malware analysis, or CTF/bug-bounty backgrounds, and it usually requires strong C/C++/assembly skills. It's a specialist track distinct from Vulnerability Management — the VM analyst consumes CVEs that researchers like this one produce.
Where you can work
- Offensive security vendors and boutique exploit-development shops
- Bug bounty platforms and independent bug bounty hunting
- Security research teams inside major software vendors (finding bugs in their own products)
- Government and defense-adjacent research organizations
- Threat intelligence and antivirus/EDR vendors researching in-the-wild exploits
What it pays
Certifications that open doors
Where you can actually learn it
Attack Surface Management Analyst
You map everything the organization exposes to the internet — including the shadow-IT and forgotten assets nobody remembers deploying — before an attacker finds it first.
What it's about & how to get in
You run external attack surface management (EASM) tooling to continuously discover internet-facing assets — domains, subdomains, cloud storage buckets, exposed APIs, forgotten dev servers — and flag the ones that shouldn't be there or aren't hardened. It's vulnerability management's outward-facing cousin: less 'patch this CVE' and more 'why does this asset even exist and who owns it.'
This role is a fairly new, fast-growing specialization that usually pulls people from vulnerability management or network security backgrounds, often after M&A activity or cloud-migration projects exposed how little visibility the org actually had into its own footprint.
Where you can work
- Enterprises going through frequent M&A (inheriting unknown external assets)
- Cloud-heavy organizations with sprawling multi-account AWS/Azure/GCP footprints
- MSSPs offering EASM as a managed service
- Vendors building EASM products (Tenable, Palo Alto Networks Cortex Xpanse, CyCognito) needing customer-facing analysts
- Financial services firms under regulatory pressure to inventory their external exposure
What it pays
Certifications that open doors
Where you can actually learn it
Security Configuration / Hardening Engineer
You take a default install and turn it into something that can survive contact with the internet — locking down configs against CIS Benchmarks and vendor guidance across the fleet.
What it's about & how to get in
You build and enforce secure baseline configurations for operating systems, cloud accounts, containers, and network devices — writing and maintaining hardening scripts/policy-as-code, running CIS-CAT or similar compliance scans, and closing the gap between 'scanned' and 'actually fixed.' It's the remediation-and-prevention half of vulnerability management, focused on configuration drift rather than missing patches.
People arrive here from sysadmin, cloud engineering, or vulnerability management backgrounds. It overlaps heavily with DevSecOps and cloud security posture management (CSPM) roles, and is a natural stepping stone into broader security architecture.
Where you can work
- Cloud security and platform engineering teams building golden images/IaC modules
- Regulated industries (finance, healthcare, government) with strict CIS/STIG compliance mandates
- Managed service providers hardening client environments at scale
- DevSecOps teams embedding hardening checks into CI/CD
- Defense and federal contractors implementing DISA STIGs