Senior Staff Security Engineer, Vulnerability Management

USA RemoteRemotePosted 7 days ago

Role Overview

Zocdoc is hiring a Senior Staff Security Engineer, Vulnerability Management. This is a full-time remote role, with the team based in USA Remote. Part of Zocdoc's Security hiring, posted last week. Full responsibilities, required qualifications, and the apply link are listed in the description below.

Salary Context

Salary is not disclosed in this posting. Market median for Staff-level Security roles is $175k-$237k (based on 65 comparable listings). Many employers share specifics during the interview process or after an initial screen.

Resume Keywords to Include

Make sure these keywords appear in your resume to improve ATS scoring

PythonGoRustAWSGCPAzureDockerKubernetes

Job description

Our Mission

Healthcare should work for patients, but it doesn’t. In their time of need, they call down outdated insurance directories. Then wait on hold. Then wait weeks for the privilege of a visit. Then wait in a room solely designed for waiting. Then wait for a surprise bill. In any other consumer industry, the companies delivering such a poor customer experience would not survive. But in healthcare, patients lack market power. Which means they are expected to accept the unacceptable.

Zocdoc’s mission is to give power to the patient. To do that, we’ve built the leading healthcare marketplace that makes it easy to find and book in-person or virtual care in all 50 states, across +200 specialties and +12k insurance plans. By giving patients the ability to see and choose, we give them power. In doing so, we can make healthcare work like every other consumer sector, where businesses compete for customers, not the other way around. In time, this will drive quality up and prices down.

We’re 18 years old and the leader in our space, but we are still just getting started. If you like solving important, complex problems alongside deeply thoughtful, driven, and collaborative teammates, read on.

Your Impact on our Mission

Zocdoc’s most important asset is our people and our platform. As a Senior Staff Engineer, Vulnerability Management, you’ll play a meaningful role in strengthening both by architecting and scaling our next-generation vulnerability detection and remediation ecosystem across Compliance, Security, and Engineering. In this role, you’ll help move our security posture from reactive firefighting to predictive, continuous risk reduction through intelligent automation, deeper full-stack visibility, and faster remediation across infrastructure, containers, and application code.

You’ll enjoy this role if you are…

Personally motivated by building secure, scalable systems that reduce real-world risk at scale.
Autonomous, urgent, and creative, and you love turning noisy security findings into actionable engineering outcomes.
Highly collaborative and energized by working across Security, Compliance, Engineering, and DevOps teams.
Passionate about offensive security, adversarial validation, and understanding how theoretical vulnerabilities translate into operational exposure.
A systems thinker who can connect infrastructure, application security, compliance, and automation into one cohesive program.
The kind of person who enjoys pairing deep technical judgment with practical execution and measurable impact.
Serious about your work, but not about yourself.

Your day to day is…

Owning the technical roadmap for an automated, AI-driven vulnerability scanning platform across cloud infrastructure, container registries, operating systems, and application-layer software.
Building context-engine models that correlate findings from SAST, DAST, SCA, and cloud posture tooling to determine true runtime exploitability.
Implementing AI-assisted triage workflows that classify vulnerabilities, reduce false positives, and route validated issues to the right engineering teams.
Leading targeted red teaming and collaborative purple teaming exercises to validate exploitable paths and strengthen runtime defenses.
Partnering directly with Software Engineering and DevOps to build automated remediation pipelines, including dependency update pull requests and base-image patching workflows.
Engineering security scanning guardrails into CI/CD pipelines and providing structured telemetry to support continuous compliance and executive risk visibility.
Working with cutting-edge GenAI tools and technology to analyze findings, improve prioritization, and accelerate remediation workflows.

You’ll be successful in this role if you have…

Meaningful experience in security engineering, vulnerability management, or software development, with at least 8 years focused on infrastructure, container platforms, and product security.
A proven track record of writing production-grade automation scripts and building custom security tooling at scale.
Hands-on experience planning or executing offensive security exercises, red teaming, purple teaming, or penetration testing.
Deep experience securing cloud infrastructure and containerized ecosystems using platforms such as AWS, GCP, or Azure, along with Docker and Kubernetes.
Advanced proficiency in Python, Go, or Rust to build automation, integrate scanner APIs, and orchestrate automated patching workflows.
Strong familiarity with adversarial frameworks, vulnerability scoring systems such as CVSS and EPSS, and common application and infrastructure attack vectors including the OWASP Top 10.
Experience integrating security scanners into CI/CD workflows and using AI or LLM APIs to analyze code or log data for rapid prioritization.
Required: the ability to integrate generative AI tools into daily workflows to automate tasks, foster innovation, and maximize productivity.
Advanced security certifications such as OSCE, OSCP, GXPN, CISSP, or equivalent practical engineering experience are highly valued.

Benefits:

Flexible work environment
Unlimited Vacation
100% paid employee health benefit options (including medical, dental, and vision)
401(k) with employer funded match
Corporate wellness programs with Headspace and Peloton
Sabbatical leave (for employees with 5+ years of service)
Competitive paid parental leave and fertility/family planning reimbursement
Cell phone reimbursement
Employee Resource Groups and ZocClubs to promote shared community and belonging
Great Place to Work Certified

Zocdoc is committed to fair and equitable compensation practices. Salary ranges are determined through alignment with market data. Base salary offered is determined by a number of factors including the candidate’s experience, qualifications, and skills. Certain positions are also eligible for variable pay and/or equity.

Remote Base Salary Range

$200,000—$290,000 USD

About us
Zocdoc is the country’s leading digital health marketplace that helps patients easily find and book the care they need. Each month, millions of patients use our free service to find nearby, in-network providers, compare choices based on verified patient reviews, and instantly book in-person or video visits online. Providers participate in Zocdoc’s Marketplace to reach new patients to grow their practice, fill their last-minute openings, and deliver a better healthcare experience. Founded in 2007 with a mission to give power to the patient, our work each day in pursuit of that mission is guided by our six core values. Zocdoc is a private company backed by some of the world’s leading investors, and we believe we’re still only scratching the surface of what we plan to accomplish.

Zocdoc is a mission-driven organization dedicated to building teams as diverse as the patients and providers we aim to serve. In the spirit of one of our core values - Together, Not Alone, we are a company that prides itself on being highly collaborative, and we believe that diverse perspectives, experiences and contributors make our community and our platform better. We’re an equal opportunity employer committed to providing employees with a work environment free of discrimination and harassment. Applicants are considered for employment regardless of race, color, ethnicity, ancestry, religion, national origin, gender, sex, gender identity, gender expression, sexual orientation, age, citizenship, marital or parental status, disability, veteran status, or any other class protected by applicable laws.

Job Applicant Privacy Notice

About Zocdoc

Zocdoc

zocdoc.com

SecurityHires remote

40 other open roles at Zocdoc on TryApplyNow.

View all 41 roles at Zocdoc Visit website

Frequently Asked Questions

How do I apply for the Senior Staff Security Engineer, Vulnerability Management position at Zocdoc?

Use the Apply button above to submit your application directly to Zocdoc. Most applications take less than 5 minutes if your resume and contact details are ready, and you'll be routed to the employer's official application system to finish.

Is the Senior Staff Security Engineer, Vulnerability Management role at Zocdoc remote?

Yes. This is a remote role. The team is based in USA Remote, but the position itself does not require relocating to that office.

What does a Senior Staff Security Engineer, Vulnerability Management at Zocdoc earn?

Zocdoc has not disclosed a salary range in this posting. Many employers share specifics later in the interview process; you can also ask during a recruiter screen if compensation transparency is important to you.

When was the Senior Staff Security Engineer, Vulnerability Management role at Zocdoc posted?

This role was posted on July 14, 2026 (7 days ago). It's still listed as actively hiring; we re-confirm openings against the source system multiple times per day and remove closed roles.

Browse Cyber Security Jobs →