Vulnerability & Attack Surface Management Analyst II at OpenLoop

Department: General and Administrative

Setup: Remote
Type: Full-time
Level: mid
Posted: Sep 24, 2026

Description

OpenLoop is hiring a Vulnerability & Attack Surface Management Analyst II to build and operate its vulnerability and attack surface management programs. The role owns the vulnerability lifecycle across cloud, container, code, and endpoint assets; prioritizes findings using a risk model; builds and maintains an asset inventory; drives remediation through engineering and platform teams; manages web application security, vulnerability disclosures, and bug-bounty intake; automates repetitive work; and reports metrics in a HIPAA-regulated environment. The position requires 3–6 years of security experience, hands-on vulnerability or CNAPP platform experience, cloud security knowledge, scripting ability, and regular use of AI tools.

Required Skills

Vulnerability management
Attack surface management
Cloud security
Vulnerability scanning
Python
AI tools
HIPAA

Additional Information

Required Previous Experiences: 3–6 years of security experience, including hands-on vulnerability, attack surface, or cloud security posture management
Hands-on experience running and tuning a vulnerability scanning or CNAPP platform
Experience prioritizing a large set of findings with a risk-based model
Cloud security fundamentals in at least one major provider, including workloads, identity, and network exposure
Experience with container and image vulnerabilities and dependency findings in code repositories
Experience working directly with engineering teams to get fixes shipped
Scripting skills sufficient to query APIs and automate reporting
Regular, hands-on use of AI tools in security work
Preferred Qualifications: Experience with Wiz, Orca, Prisma Cloud, Defender for Cloud, Lacework, CrowdStrike Falcon Exposure Management, Tenable, Qualys, or Rapid7
Experience with external ASM tools, recon methods, CAASM, Axonius, runZero, or SaaS discovery tools
Experience with DAST, edge/WAF platforms, and vulnerability disclosure or bug bounty programs
Experience with hardened base images, Kubernetes, PaaS, SBOMs, and scanner API automation
Experience in healthcare, fintech, or another regulated environment, including HIPAA, HITRUST, or SOC 2 work
GCLD, GCPN, GWEB, GSEC, AWS or GCP security specialty, OSCP, or equivalent certification
Translation Company Name: OpenLoop Health