Security Controls Engineer

About the Role

Gen Digital is hiring a Security Controls Engineer to translate regulatory and security framework requirements into actionable vulnerability management and remediation programs across security and DevOps teams. You'll design and operationalize the vulnerability management lifecycle—from identification through remediation, validation, and reporting—while coordinating secure development practices, patch management, and post-deployment monitoring within regulatory frameworks. This role requires close partnership with a Senior Project Manager and direct engagement with senior leadership.

Responsibilities

• Translate legal, regulatory (including Cyber Resiliency Act), and security framework obligations into prioritized, testable tasks; define concrete technical control requirements for vulnerability detection, remediation SLAs, secure configuration baselines, SBOM management, and coordinated disclosure processes.
• Own the end-to-end vulnerability management lifecycle across infrastructure, cloud, applications, containers, and third-party components—including scanning, triage, risk-based prioritization (CVSS plus exploitability and business impact), remediation tracking, validation, and closure.
• Integrate security scanning (SAST, DAST, SCA, container, IaC, and cloud configuration) into CI/CD pipelines in partnership with the Application Security team; ensure findings are automatically ticketed, risk-ranked, and tracked to resolution with measurable SLAs.
• Coordinate work across multiple security domains (IAM, vulnerability management, cloud security, application security) and DevOps/Platform teams to drive consistent adoption and operationalization.
• Build and maintain delivery plans, track milestones, manage dependencies, and serve as a single source of truth using tools like Jira or Azure Boards.
• Align with product owners, architects, and security subject matter experts; resolve blockers and facilitate key decisions.
• Develop dashboards and reports that track vulnerability aging, SLA compliance, backlog trends, recurring vulnerability patterns, risk exposure, and remediation plans for senior leadership review.
• Map vulnerability management practices to regulatory frameworks and collect evidence for audit compliance and control assessment.
• Standardize templates, automate playbooks and evidence collection, and reduce manual triage effort to advance program maturity.
• Work closely with a Senior Project Manager to align scope, timelines, compliance deadlines, and cross-team execution.

Requirements

• Bachelor's degree in Information Technology or a related cybersecurity field (preferred).
• 3+ years of experience in vulnerability management, security engineering, or security program delivery in a cloud or software environment.
• Demonstrated ability to work independently and drive outcomes across multiple teams.
• Working understanding of regulatory security requirements and hands-on experience implementing common frameworks (ISO 27001, NIS2, SOC 2, GDPR, PCI DSS).
• Strong ability to translate policy and control language into developer-ready user stories, acceptance criteria, remediation tasks, and runbooks.
• Hands-on experience with work tracking tools (Jira, Azure DevOps, or similar) and creating status reports and dashboards for leadership.
• Excellent communication skills; comfortable analyzing vulnerability trends including aging and patch latency, with clear writing ability and demonstrated stakeholder alignment experience.
• Understanding of modern SDLC and DevOps practices (CI/CD, IaC, pipelines, change management).
• Experience in cloud environments (AWS, Azure, or GCP), including shared responsibility models and guardrail patterns.

Benefits

• Flexible working options and time off.
• Competitive compensation package.
• Well-being and benefits programs.
• Tools and support for professional growth and career development.