Sr. Threat & Vulnerability Management Engineer

As a Senior Threat and Vulnerability Management (TVM) Engineer on Medica's Cyber Security team, you will be responsible for identifying, assessing, and driving remediation of vulnerabilities across Medica's on-premise and cloud environments. Your work will directly support the organization's risk reduction efforts and security maturity through proactive vulnerability discovery, threat modeling, and continuous improvement of detection and response capabilities. Perform other duties as assigned.

Key Accountabilities:

• Conduct vulnerability research to identify and assess potential security flaws, followed by penetration testing to confirm exploitability.
• Monitor threat intelligence feeds for new vulnerabilities and assess their impact on the organization
• Maintain documentation and dashboards to track vulnerability status and remediation progress
• Collaborate with Internal Security teams, Product Owners, Scrum Masters, and management
• Find innovative solutions to problems to maintain a secure environment.

Candidates should have a strong understanding of vulnerability management frameworks, system hardening, secure configuration baselines, threat intelligence, and risk prioritization. Familiarity with tools such as Qualys, Tenable, or Rapid7, as well as cloud-native security services, is essential. The ability to think critically, correlate threat data with asset risk, and communicate findings effectively to both technical and non-technical stakeholders is highly valued by our team.

Qualifications:

• Bachelors degree or equivalent combination of education and work experience
• 5+ years of professional experience within Information Technology with 3+ years of work experience in a Threat and Vulnerability Management role

Additional Experience and Skills:

• Experience with vulnerability management tools such as: Nessus, Tenable.io, Rapid7 InsightVM, or Qualys
• Experience with cloud and container technologies like AWS, Azure, GCP, and Kubernetes
• Experience with a variety of security tools and techniques and the ability to write scripts to automate tasks. Understanding of reverse engineering with tools such as GHIRDA, IDA Pro and others
• Strong knowledge of various operating systems (Windows, Linux), networks and cloud infrastructures, especially experience with Linux, Windows, and Active Directory
• Proficiency in various scripting and programming languages such as Python, JavaScript, PowerShell, or C++
• Knowledge of web application security, including experience with web application scanners and manual testing techniques and pen testing
• Strong communication and report-writing skills
• A degree or one recognized certification such as the CPTS penetration testing, CompTIA PenTest+, OSCP or equivalent work experience is ideal

This position is an Office role, which requires an employee to work onsite at our Minnetonka, MN office, on average, 3 days per week.

The full salary range for this position is $100,200 - $171,700. Annual salary range placement will depend on a variety of factors including, but not limited to, education, work experience, applicable certifications and/or licensure, the position's scope and responsibility, internal pay equity and external market salary data. In addition to base compensation, this position may be eligible for incentive plan compensation in addition to base salary. Medica offers a generous total rewards package that includes competitive medical, dental, vision, PTO, Holidays, paid volunteer time off, 401K contributions, caregiver services and many other benefits to support our employees.

The compensation and benefits information is provided as of the date of this posting. Medica's compensation and benefits are subject to change at any time, with or without notice, subject to applicable law.

We are an Equal Opportunity employer, where all qualified candidates receive consideration for employment indiscriminate of race, religion, ethnicity, national origin, citizenship, gender, gender identity, sexual orientation, age, veteran status, disability, genetic information, or any other protected characteristic.