Note: The job is a remote job and is open to candidates in USA. Avaya is hiring an Infrastructure Security Vulnerability Engineer to manage vulnerability identification, prioritization, tracking, and remediation across infrastructure and applications in a cloud-based FedRAMP Moderate environment supporting U.S. federal requirements. The role coordinates remediation with technical and risk teams, uses vulnerability assessment and cloud-based AI tools, and maintains risk reporting and process improvements.
Responsibilities
- Lead and coordinate vulnerability remediation activities across infrastructure and applications, ensuring identified vulnerabilities are tracked, prioritized, and resolved in accordance with established security requirements and remediation timelines
- Evaluate vulnerabilities using CVE and CVSS data, exploitability, threat intelligence, asset criticality, attack paths, exposure information, and other relevant risk indicators to help determine remediation priorities
- Support vulnerability remediation activities aligned with applicable CISA BOD 26-04 requirements and other relevant federal cybersecurity directives, including monitoring remediation progress against required deadlines
- Support vulnerability assessment and remediation across Windows Server 2019 and above, Linux/RHEL 9.x and above, and application environments. Work with technical teams to identify appropriate remediation approaches, including patching, configuration changes, and other corrective actions
- Use tools such as Tenable Security Center, Nessus, and Qualys to review vulnerability findings, validate remediation status, identify outstanding exposures, and support ongoing vulnerability management operations
- Partner with application owners, application managers, infrastructure teams, vendor managers, and risk partners to communicate findings, clarify remediation requirements, resolve technical or process-related questions, and drive issues to closure
- Maintain accurate vulnerability records in ServiceNow or other designated systems of record. Update remediation status, document actions taken, track outstanding items, and ensure records reflect the current state of identified vulnerabilities
- Coordinate patching and remediation activities with application and infrastructure teams, following established change management processes and supporting timely, controlled implementation of corrective actions
- Support vulnerability exception management, risk-based remediation decisions, incident-driven response activities, and escalation of overdue or unresolved vulnerabilities to the appropriate stakeholders
- Leverage cloud-based AI tools, where appropriate, to support vulnerability identification, analysis, prioritization, and remediation workflows while applying sound security judgment and established review processes
- Develop and maintain periodic vulnerability management metrics and reports, including remediation progress, aging vulnerabilities, overdue findings, risk trends, and other indicators used to communicate exposure and remediation effectiveness
- Identify opportunities to improve vulnerability management procedures, remediation workflows, reporting accuracy, and operational efficiency. Maintain clear documentation of findings, remediation activities, exceptions, and supporting processes
Skills
- Eligibility Requirement: US Citizenship Required
- 3–5+ years of experience in vulnerability management, vulnerability remediation, patch management, or a closely related infrastructure security role
- Hands-on experience with vulnerability assessment and management tools, including Tenable Security Center, Nessus, and Qualys
- Working knowledge of Windows Server 2019 and later, including vulnerability remediation, security patching, and system configuration
- Experience supporting Linux environments, particularly Red Hat Enterprise Linux (RHEL) 9.x and later, including security updates, patching, and vulnerability remediation
- Understanding of CVE and CVSS analysis, vulnerability prioritization, exploitability, threat intelligence, asset criticality, and exposure-based remediation practices
- Demonstrated experience coordinating vulnerability remediation and patch management activities, tracking findings through closure, and working with technical teams to resolve outstanding security issues
- Familiarity with change management processes and the ability to coordinate remediation activities while supporting operational stability and established controls
- Experience using ServiceNow ticketing or similar systems to track vulnerabilities, document remediation progress, manage escalations, and maintain accurate records
- Strong Microsoft Excel and reporting skills, with the ability to analyze vulnerability data, track remediation metrics, identify trends, and communicate risk status clearly
- Strong written and verbal communication skills, with the ability to work effectively with application owners, infrastructure teams, vendors, and risk stakeholders to drive remediation outcomes
- Strong analytical, organizational, and troubleshooting skills, with the ability to investigate technical findings, clarify remediation requirements, and manage multiple priorities in a deadline-driven environment
- Ability to work within a regulated cloud environment and follow established security, compliance, documentation, and risk management processes
- Must be a US citizen
- 5 - 6 years of experience and a Bachelor degree or equivalent, or 4 years of experience and a Master degree or equivalent
- Bachelor degree or equivalent experience
- Master degree or equivalent experience
- Applicants must be currently authorized to work in the United States without the need for visa sponsorship now or in the future
- Familiarity with FedRAMP, NIST SP 800-53, DISA Security Technical Implementation Guides (STIGs), and federal cybersecurity compliance requirements
- Experience using CISA Known Exploited Vulnerabilities (KEV) information and other threat intelligence sources to prioritize remediation based on active exploitation and emerging threats
- Experience supporting US federal government, Department of Defense (DoD), or other regulated enterprise environments
- Experience using PowerShell, Bash, or Python to automate vulnerability analysis, reporting, patch management, or remediation workflows
- Familiarity with ManageEngine Endpoint Central or similar endpoint management and patch deployment platforms
- Experience supporting VMware environments and Active Directory infrastructure
- Experience identifying and coordinating remediation of application vulnerabilities, including web application security findings
- Familiarity with cloud security technologies and AI-assisted tools used for vulnerability analysis, security operations, and risk reduction
- A track record of improving vulnerability remediation timelines, strengthening reporting processes, and reducing technology risk through effective coordination and automation
- Relevant cybersecurity, vulnerability management, infrastructure security, or cloud security certifications are desirable
- Examples include CompTIA Security+, CompTIA CySA+, Certified Information Systems Security Professional (CISSP), and other relevant security certifications
Company Overview