Position Overview

We are seeking a Security Platform Engineer specializing in Tool Configuration and Data Unification to bring deep security domain expertise to the hands-on configuration of our scanning and aggregation stack. This role is responsible for unifying the output of multiple security scanners into a single, coherent vulnerability language. You will tune what each tool detects, define how findings are normalized and deduplicated, and design the data model that transforms raw scanner output into defensible, evaluated vulnerability records.

Working alongside DevSecOps engineers and GRC engineers, you will own the intelligence and structure of the security data pipeline — determining what flows through it and how it is shaped — to support FedRAMP compliance, audit evidence requirements, and actionable vulnerability management at scale.

Key Responsibilities

- Own scanner configuration and tuning across the detection fleet: scan policies, coverage scope, severity mappings, and signal quality for Trivy, Semgrep, Qualys, Tenable, AWS Inspector, CrowdStrike, and

Dependabot

- Design the deduplication and correlation strategy in DefectDojo: keying logic that recognizes the same vulnerability across image scans, runtime scans, host scans, and dependency scans, plus grouping rules that collapse duplicates into single actionable findings (target: ~70% ticket reduction)
- Define the unified findings data model — field schema, asset identity, component mapping — that supports the FedRAMP 11-field vulnerability detail and 8-field accepted-vulnerability reporting schemas
- Build the reachability signal layer: AWS Reachability Analyzer, service mesh, and eBPF-based signals feeding an internet-reachability (IRV/NIRV) determination per finding




- Configure runtime visibility (CrowdStrike Falcon Cloud Security) and reconcile runtime observations against image-scan results to close the rebuilt-but-not-redeployed gap
- Partner with the GRC engineer to ensure the data model captures everything the LEV × IRV × PAIN evaluation engine and audit evidence require
- Validate detection coverage against the workplace (containers, hosts, serverless, dependencies,

external surface) and identify blind spots

Required Skills

- 6+ years in security engineering with hands-on vulnerability management depth
- Understanding of CVEs, CPE/PURL identity, scanner false-positive patterns, and scanner disagreement analysis
- Demonstrated experience configuring and tuning multiple commercial and open-source scanning tools in production
- Strong data modeling skills applied to security findings: normalization, deduplication, enrichment, asset correlation
- Cloud security expertise in AWS including container security (image scanning, registry policy, runtime security) on EKS/ECS
- Working knowledge of exploitability intelligence: CISA KEV, EPSS, VEX, and vulnerability prioritization
- Experience with Trivy, Semgrep, Qualys, Tenable, AWS Inspector, CrowdStrike, and Dependabot
- Experience with DefectDojo for vulnerability aggregation and deduplication

Preferred (Bonus) Skills

- DefectDojo experience, particularly its deduplication engine, parsers, and API
- Experience with network reachability analysis (AWS Reachability Analyzer, service mesh telemetry,

eBPF tooling)
- Familiarity with FedRAMP VDR/VER concepts: LEV (Likely Exploitable), IRV/NIRV (Internet-Reachable),

PAIN ratings, and timeframe classes
- • Experience writing custom scanner parsers or findings-transformation code in Python

📌 Security Platform Engineer — (Contract) (India)
🏢 VettedBench
📍 India