Senior Security Engineer – Vulnerability Management

We're not hiring someone to run scans. We're hiring someone to build the engine that finds and closes risk before it becomes an incident. We're looking for a Tech Lead who thinks like an attacker prioritizing targets, not an analyst clearing a scan queue. Someone who owns the full vulnerability lifecycle, builds AI-driven prioritization into the pipeline, and turns remediation into a measurable, automated system instead of a spreadsheet of open tickets. You'll lead Vulnerability Management across cloud, infrastructure, endpoints, and internal environments - turning every scan, exception, and remediation into a shorter exposure window and a more mature program. The goal isn't to keep the vulnerability count low on a dashboard. It's to make exploitable exposure structurally rare. Why This Matters Deriv's mission is Trading for Anyone, Anywhere, Anytime. Millions of traders across the globe, around the clock, across regulatory environments. At this scale, an unpatched exposure sitting past its SLA isn't a compliance footnote - it's a trader's funds at risk and a regulator on the phone. Vulnerability Management is a core defensive layer for a platform that never stops processing transactions. When new assets, cloud workloads, and code ship continuously, your discovery and remediation engine can't fall behind - which is exactly why this role exists to turn Vulnerability Management into a fully automated, intelligence-driven function. The Challenge Most vulnerability programs are a scan, a spreadsheet, and a monthly report nobody reads until an audit forces the question. That's not this role. You'll own the vulnerability lifecycle end to end: discovery, enrichment, risk-based prioritization, remediation, validation, and executive reporting, across AWS, GCP, Azure, Kubernetes, containers, endpoints, and network infrastructure. You'll be building automated workflows and AI-assisted prioritization that cut exposure windows quarter over quarter, not chasing CVSS scores in isolation. If your idea of vulnerability management is exporting a Qualys report and emailing it to engineering, this isn't for you. If you want to architect an automation-first vulnerability engine at global scale and be the technical authority behind it, keep reading. Why Deriv Deriv protects millions of global traders across distributed platforms and