Senior Security Engineer – Vulnerability Management

About the role

Deriv is looking for a Tech Lead to own Vulnerability Management across cloud, infrastructure, endpoints and internal environments. The role is about building an automation-first, intelligence-driven engine that finds and closes risk before it becomes an incident, rather than running scans and producing reports. It sits in Cyberjaya and covers AWS, GCP, Azure, Kubernetes, containers, endpoints and network infrastructure.

Key responsibilities

• Own the full vulnerability lifecycle: discovery, enrichment, prioritization, remediation, validation and executive reporting.
• Lead the operation and optimization of Qualys VMDR (Cloud Agents, SCA, PCI, dashboards, tagging, scan profiles) across cloud, Kubernetes, containers, endpoints and office/network infrastructure.
• Implement risk-based prioritization using CVSS, EPSS, CISA KEV, exploit intelligence and asset criticality, and design exception management and risk acceptance governance.
• Define and enforce remediation SLAs, reduce exposure windows (MTTR) and aging vulnerabilities, and correlate findings with CSPM, IAM exposure and threat intelligence.
• Strengthen integration between vulnerability data, SIEM, EDR and cloud-native controls, supporting hardening aligned with CIS, NIST, ISO 27001, PCI-DSS and DORA.
• Design automated workflows for intake, ticket creation, assignment, tracking and validation, and use AI to enrich vulnerability context.
• Act as the bridge between Global Security Operations and local IT/Engineering, and mentor analysts in risk-based triage and exploit analysis.

Required profile

• 8-12+ years of cybersecurity experience with deep specialization in vulnerability management.
• Expert-level experience with Qualys VMDR (or equivalent such as Tenable or Rapid7).
• Strong understanding of exploit intelligence, risk scoring models and vulnerability lifecycle governance.
• Hands-on experience in cloud security, CSPM, endpoint patching, SIEM/EDR correlation and regulated environments (ISO 27001, GDPR, PCI-DSS, DORA).
• Proven ability to build dashboards and KPIs that influence executive decisions.

Required skills

• Automation: Python, Bash, API integrations and workflow automation.
• Experience implementing AI-assisted prioritization or remediation workflows.
• Strong communicator able to translate technical exposure into business risk.