Security Engineer – Attack Surface Management (ASR)

About Exegy

Exegy is a global leader in intelligent market data, advanced trading systems, and future-proof technology. Exegy serves as a trusted partner to the complete ecosystem of the buy-side, sell-side, exchanges, and financial services technology firms around the globe. Headquartered in St. Louis with regional offices in North America, the UK/Europe and Asia Pacific, Exegy has the global footprint to deliver world-class support and managed services to its customer base of elite financial market participants.

Job Summary

We are seeking a hands-on Security Engineer – ASR to own and mature our vulnerability management program with a clear mandate to reduce real organizational risk and shrink our attack surface. This role goes beyond scanning and reporting—success is measured by fewer exploitable weaknesses, faster remediation, and sustained risk reduction over time.

The ideal candidate is analytical, persistent, and pragmatic, with the ability to translate vulnerability data into clear, risk-based prioritized actions that engineering and /or IT teams can execute.

Responsibilities

Risk-Driven Vulnerability Management

• Own the end-to-end vulnerability lifecycle: discovery, prioritization, remediation tracking, and validation
• Maintain accurate asset and exposure visibility across endpoints, servers, cloud workloads, SaaS, and internet-facing systems
• Perform regular vulnerability scanning and ad-hoc assessments
• Prioritize remediation based on real-world risk, considering:
• Exploitability and threat intelligence
• Asset criticality and business impact
• Exposure (internet-facing, privileged systems, sensitive data)
• Reduce vulnerability noise by deduplicating findings and focusing teams on what matters most
• Track remediation progress and validate fixes
  

Attack Surface Reduction

• Identify and eliminate:
• Unmanaged or unknown assets
• Legacy systems with chronic vulnerabilities
• Misconfigurations that expand attack surface
• Partner with IT and Engineering to:
• Improve patching cadence
• Enforce secure configuration baselines
• Reduce recurring vulnerability patterns
• Recommend compensating controls where remediation is not immediately feasible
  

Threat Awareness & Continuous Improvement

• Conduct targeted threat analysis and light threat hunting to identify exploitation attempts and abnormal authentication or privilege activity
• Feed threat intelligence and observed attacker behavior back into vulnerability prioritization
• Improve detection, hardening, and prevention based on findings
  
  

Collaboration & Communication

• Work closely with IT, Engineering, and Infrastructure teams to drive remediation outcomes
• Translate technical vulnerabilities into clear, actionable risk statements
• Provide leadership with concise, outcome-focused metrics and trend reporting
• Contribute to security standards, procedures, and operational improvements
  
  

Success Metrics

• Reduction in critical and high-risk vulnerabilities over time
• Mean time to remediate (MTTR)
• Percentage of assets with known ownership and patch coverage
• Reduction in repeat or systemic vulnerabilities
• Demonstrated attack surface reduction (fewer exposed services, unused assets, misconfigurations)
  
  

Our Ideal Candidate Has

Technical Experience

• 3 years of hands-on experience in security engineering, vulnerability management, or a closely related discipline
• Strong working knowledge of common vulnerability classes, exploitation techniques, and attacker methodologies
• Solid foundation in operating systems, networking concepts, and cloud fundamentals
• Experience using vulnerability scanning, detection, and security monitoring tools to identify and assess risk
• Demonstrated ability to prioritize remediation efforts based on business and technical risk rather than raw finding volume
  
  

Risk & Threat Awareness

• Familiarity with how vulnerabilities map real-world attack techniques and threat models
• Working knowledge of widely adopted security frameworks and control sets (e.g., MITRE ATT&CK, NIST CSF, ISO 27001, CIS Controls)
• Ability to contextualize vulnerability findings within broader security, operational, and compliance considerations
  
  

Execution & Communication Approach

• Capable of clearly documenting vulnerability findings, risk rationale, and remediation guidance
• Effective in working with engineering, infrastructure, and IT teams to drive timely remediation
• Comfortable translating technical findings into actionable work items and recommendations
  
  

Experience That Enhances Impact

• Experience operating in lean or resource-constrained environments where prioritization and pragmatism are critical
• Exposure to integrating vulnerability findings into ticketing, backlog management, or ITSM workflows
• Relevant security certifications (e.g., Security , CEH, CISSP) or equivalent practical experience are beneficial but are not required