Security Specialist, Vulnerability Management (US - Remote)

AXON Networks delivers a robust AI-driven, analytics-based orchestration platform and a wide portfolio of next-gen high-speed routers that leverage the newest Wi-Fi technologies. Together, these technologies give ISPs the ability to manage and troubleshoot their networks in real time, and to deliver an outstanding customer experience.

AXON Networks is a trusted strategic partner for its customers, helping them evaluate their current technologies and business models, and creating and executing strategies that enable them to innovate faster, accelerate their digital transformations, and strengthen their relationships with consumers.

AXON Networks is headquartered in Irvine, CA USA with Asia HQ in Singapore and also operating in Denmark, Spain and Vietnam.

The Security Specialist, Vulnerability Management will establish and operate a risk-based vulnerability management capability across the company’s cloud platform, applications, Kubernetes and container environments, network infrastructure, software supply chain, and cloud-managed customer-premises equipment (CPE), including broadband gateways, routers, ONTs and connected-home devices. This is a hands-on security engineering role for someone who can distinguish a scanner finding from a vulnerability that is relevant and exploitable in the company’s actual environment. 

The engineer will select and configure scanning approaches, validate findings, analyze CVEs, prioritize risk, coordinate remediation, verify closure and create the dashboards, evidence and operating standards needed for a repeatable program. The engineer will explain risk clearly to operational and engineering leaders and will not rely on severity scores alone. 

Role mandate 

• Establish authoritative visibility into vulnerabilities across cloud, application, container, Kubernetes, network, endpoint, dependency, firmware and CPE asset classes. 

• Determine whether findings and CVEs apply to the versions, configurations, exposure paths and controls actually present in the environment. 

• Prioritize remediation using technical severity, known exploitation, likelihood, reachability, asset criticality, customer impact and compensating controls. 

• Create a durable operating model for intake, validation, assignment, service levels, exceptions, rescanning, closure and executive reporting. 

• Partner with Engineering, DevOps, NOC, Support, Product and Compliance to reduce measurable exposure without disrupting reliable customer service. 

What you will own 

Scanning strategy and coverage 

• Inventory the attack surface and define coverage for internet-facing and internal assets, cloud services, hosts, network devices, containers, Kubernetes clusters, applications, APIs, source code, third-party dependencies, images, infrastructure as code and supported CPE/firmware. 

• Design, configure and maintain authenticated and unauthenticated scans, agent-based assessments, cloud-native configuration checks, container and dependency scans, external attack-surface discovery and targeted validation tests. 

• Establish safe scan windows, credentials, rate limits, exclusions and testing procedures so scans do not destabilize production, customer environments or large CPE fleets. 

• Evaluate, select and administer appropriate capabilities from platforms such as Tenable Nessus, Qualys, Rapid7, Wiz, Orca, Prisma Cloud, Snyk, Veracode, Checkmarx, Trivy, Grype, Nuclei or equivalent tools; integrate results rather than requiring one product to solve every use case. 

• Measure coverage, scan health, credential success, stale assets and blind spots; continuously improve asset-to-owner mapping and data quality. 

Finding validation and CVE analysis 

• Review new and existing scan findings and determine whether each is a true positive, false positive, duplicate, accepted risk, mitigated condition or actionable vulnerability. 

• Analyze CVE applicability using affected component and version, package provenance, CPE or firmware bill of materials, runtime reachability, configuration, network exposure, privileges, exploit prerequisites and existing controls. 

• Reproduce or safely validate material findings when needed using vendor advisories, proof-of-concept analysis, logs, configuration evidence, package inspection and non-production testing. 

• Document defensible disposition evidence and prevent unsupported suppression of findings or indefinite exception status. 

• Monitor vulnerability intelligence and vendor advisories for cloud, Kubernetes, Linux, networking, broadband/CPE, open-source and commercial technologies used by the company. 

Risk-based prioritization and response 

• Use CVSS as a severity input, not a standalone risk decision, and enrich prioritization with CISA Known Exploited Vulnerabilities, EPSS, exploit availability, exposure, reachability, asset criticality, tenant/customer impact and compensating controls. 

• Define remediation and mitigation targets by risk tier; rapidly escalate actively exploited or internet-reachable vulnerabilities and coordinate emergency response when required. 

• Create clear remediation records with affected assets, evidence, owners, due dates, recommended actions, validation criteria and customer or operational considerations. 

• Partner with Engineering and DevOps on patches, upgrades, configuration changes, image rebuilds, dependency updates, firmware releases and compensating controls; verify closure through rescans or equivalent evidence. 

• Manage risk exceptions with documented rationale, accountable approval, compensating controls, expiration dates and scheduled reassessment. 

Cloud-to-CPE security context 

• Understand the end-to-end service path from cloud control plane and APIs through messaging, device-management protocols and access networks to broadband gateways, routers, ONTs and connected-home devices. 

• Assess vulnerabilities in the context of multi-tenant cloud services, remote device management, certificates and secrets, provisioning, telemetry, firmware delivery, administrative interfaces and fleet-scale exposure. 

• Work with Engineering to identify affected device models, hardware revisions, firmware branches, software components and deployed cohorts; support safe remediation planning and rollout validation. 

• Recognize the different evidence and remediation paths required for cloud software, third-party dependencies, network appliances, embedded Linux and customer-deployed CPE. 

Program operations, automation and reporting 

• Build integrations and automation for asset enrichment, deduplication, risk scoring, ticket creation, ownership routing, SLA tracking, notifications, rescans, exception expiry and evidence collection. 

• Maintain dashboards for coverage, exploitable exposure, aging, remediation performance, repeat findings, exceptions, asset ownership and risk trends by service, customer, product and device cohort. 

• Develop playbooks, standards and procedures for routine vulnerability handling, critical CVEs, zero-day response, scanner administration and tool outages. 

• Provide concise reporting to technical owners and leaders, separating raw finding volume from material risk and clearly identifying decisions or overdue actions. 

• Support audits and customer security inquiries with traceable evidence while protecting sensitive vulnerability and customer information. 

Required qualifications 

• 5+ years of hands-on experience in vulnerability management, vulnerability assessment, security engineering, product security, cloud security or a closely related discipline. 

• Demonstrated ownership of enterprise scanning and vulnerability-management workflows, including scanner configuration, authenticated scanning, coverage analysis, finding validation, false-positive handling, remediation tracking and rescanning. 

• Strong CVE analysis skills and the ability to determine applicability and exploitability using versions, configurations, exposure, reachability, privileges, controls and business context. 

• Experience with one or more enterprise vulnerability platforms and practical familiarity with complementary cloud, container, dependency, application and open-source scanning tools. 

• Working knowledge of CVE/CWE, NVD, CVSS, CISA KEV, EPSS, vendor advisories, software bills of materials and risk-based prioritization. 

• Hands-on knowledge of Linux, TCP/IP, DNS, TLS/PKI, identity and access controls, APIs, cloud infrastructure, containers and Kubernetes. 

• Ability to read code, package manifests, container images, configurations, logs and network evidence sufficiently to validate findings and guide remediation. 

• Scripting or programming ability in Python, Go, PowerShell, Bash or a comparable language, plus experience integrating security platforms with APIs, ticketing and dashboards. 

• Strong written and verbal communication, including the ability to explain technical risk, uncertainty, tradeoffs and required decisions to engineers and operational leaders. 

• Bachelor’s degree in cybersecurity, computer science, engineering or equivalent practical experience. 

Preferred qualifications 

• Security experience with service providers, broadband operators, telecom equipment/software vendors, managed-network providers or large distributed device fleets. 

• Experience assessing embedded Linux, firmware, broadband gateways, routers, ONTs, Wi-Fi/mesh systems or other CPE/IoT products. 

• Familiarity with TR-069/CWMP, TR-369/USP, TR-181, ACS/USP controllers, device provisioning, telemetry, certificates and remote firmware lifecycle management. 

• Experience with Google Cloud Platform, Kubernetes, Terraform, Helm, CI/CD and cloud-native security posture or workload-protection platforms. 

• Experience with software composition analysis, SBOM/VEX, container/image scanning, secret scanning, SAST/DAST/API security testing and infrastructure-as-code scanning. 

• Experience with coordinated vulnerability disclosure, penetration-test finding intake, zero-day response or product security incident response. 

• Familiarity with NIST Cybersecurity Framework, NIST SP 800-40, CIS Controls, OWASP guidance, PCI DSS, SOC 2 or ISO 27001 control expectations. 

• Relevant certifications such as Security+, CySA+, GSEC, GCIH, GPEN, CISSP, CCSP or vendor-specific vulnerability-management credentials; practical expertise is valued more than certification alone. 

Working expectations 

• Work primarily during normal business hours with escalation availability for critical, actively exploited or zero-day vulnerabilities. 

• Handle sensitive vulnerability, exploit and customer information with strict need-to-know access and evidence controls. 

• Coordinate intrusive scans, validation tests and production-impacting work through approved change and maintenance processes. 

• Challenge scanner results and remediation claims constructively while maintaining clear evidence, ownership and deadlines. 

This position is fully remote within North America. Please note that we are unable to offer visa sponsorship for this role.

Annual salary range: $120,000 - $175,000

Join AXON Networks!

At AXON Networks, we promote equal opportunities in all our recruitment processes, ensuring non-discrimination on the basis of gender, age, origin, disability, or any other personal circumstances. We assess talent based on objective criteria and foster an inclusive and diverse working environment.

axon-networks.com

axon-networks.hire.trakstar.com