Job description

Deriv processes trades for millions of people around the clock across regulatory environments, so an unpatched exposure sitting past its SLA there puts real trader funds and regulatory standing on the line. This Senior Security Engineer role owns the full vulnerability lifecycle end to end, covering discovery, enrichment, risk based prioritization, remediation, validation and executive reporting. Coverage spans AWS, GCP, Azure, Kubernetes, containers, endpoints and network infrastructure, with Qualys VMDR at the center of daily operation and optimization. You'll implement risk based prioritization using CVSS, EPSS, CISA KEV, exploit intelligence and asset criticality, and design exception management and risk acceptance governance that actually holds up. Remediation SLAs get defined and enforced across engineering and IT, with exposure windows and aging vulnerabilities shrinking quarter over quarter as a result. Vulnerability findings get correlated with CSPM insights, IAM exposure and threat intelligence, and tighter integration between vulnerability data, SIEM, EDR and cloud native security controls supports hardening against CIS, NIST, ISO 27001, PCI-DSS and DORA. Automated workflows cover vulnerability intake, ticket creation, assignment, tracking and remediation validation, and AI gets used to enrich context around exploitability, clustering, attack paths and asset importance. As the technical authority for Vulnerability Management, you'll mentor analysts in risk based triage and exploit analysis, bridge Global Security Operations with local IT and Engineering, and represent the function during audits and architecture reviews.