Vulnerability Management AI Researcher

### Role Summary We are seeking a Vulnerability Management engineer to join our team as both a vulnerability management practitioner and an automation builder. This role combines traditional vulnerability analysis and remediation coordination with a strong emphasis on developing AI-powered tools and automations that scale the team's effectiveness. You will analyze vulnerabilities across infrastructure, cloud, and application layers, coordinate remediation with engineering teams, and build automation that makes the entire program faster and smarter. ### Key Responsibilities **Vulnerability Discovery & Security Research** - Conduct deep-dive source code audits of UKG products (Java, .NET, Python, JavaScript) to discover novel vulnerabilities (e.g., authentication bypasses, injection flaws, cryptographic weaknesses). - Develop working proof-of-concept exploits to demonstrate real impact. - Perform variant analysis to systematically search for similar root cause patterns across the codebase. - Triage and validate findings from automated scanners (SAST, DAST, SCA). - Investigate and reproduce externally reported vulnerabilities (bug bounty, CVEs). - Collaborate with engineering teams to design, validate, and drive remediation. **AI-Powered Vulnerability Automation** - Build AI-assisted vulnerability discovery tools using automation (Claude, MCP servers, custom models) for source code analysis and exploit generation. - Develop autonomous security scanning agents that identify vulnerability patterns with minimal human intervention. - Create AI-powered remediation tools that generate fix recommendations, patches, and pull requests. - Build automated vulnerability lifecycle pipelines, including intake, triage, deduplication, and intelligent ticket routing. - Contribute to shared automation repositories. **Vulnerability Management & Remediation Driving** - Own remediation outcomes for assigned product areas, holding engineering teams accountable to SLAs. - Produce clear, actionable vulnerability reports including root cause, impact, and reproduction steps. - Drive reduction in mean time to remediate (MTTR) through improved automation and collaboration. - Support vulnerability management program metrics, dashboards, and compliance-driven requirements (e.g., FedRAMP). **Research & Knowledge Sharing** - Publish research on novel vulnerability classes and AI-assisted discovery techniques. - Stay current on emerging threats and defensive patterns. - Mentor team members on research methodology and AI-augmented security tooling. ### Required Qualifications - 7+ years of experience in vulnerability research, application security, or penetration testing. - Proficiency in reading/auditing source code: Java, C#/.NET, Python, JavaScript/TypeScript, Go, or C/C++. - Experience developing functional proof-of-concept exploits. - Strong Python skills for security tooling and automation pipelines. - Experience with AI/ML tools for security (LLMs, autonomous agents). - Deep understanding of common vulnerability classes (Injection, broken authentication, cryptographic failures, etc.). - Experience managing vulnerability remediation across engineering organizations. - Excellent written communication skills for technical and executive reporting. - Bachelor's degree in Computer Science, Cybersecurity, or equivalent experience.