Infrastructure Security Vulnerability Engineer (virtual, US)

About this role

About Avaya

Avaya is an enterprise software leader that helps the world’s largest organizations and government agencies forge unbreakable connections.

The Avaya Infinity™ platform unifies fragmented customer experiences, connecting the channels, insights, technologies, and workflows that together create enduring customer and employee relationships.

We believe success is built through strong connections – with each other, with our work, and with our mission. At Avaya, you'll find a community that values your contributions and supports your growth every step of the way.

Learn more at

Job Description

Eligibility Requirement: US Citizenship Required

Reduce Risk. Accelerate Remediation. Strengthen Infrastructure Security.

Are you passionate about cybersecurity, vulnerability management, and reducing technology risk across complex cloud environments? Do you enjoy analyzing security vulnerabilities, partnering with technical teams, and driving remediation efforts that strengthen the security and resilience of critical systems?

We’re looking for two Infrastructure Security Vulnerability Engineers to help identify, prioritize, track, and remediate vulnerabilities across infrastructure and applications within a cloud-based FedRAMP Moderate-compliant environment supporting US federal government requirements.

This role will focus on accelerating vulnerability remediation in alignment with applicable Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive (BOD) 26-04 requirements, leveraging threat intelligence, exposure data, and cloud-based AI tools to help application and infrastructure teams address security risks efficiently and effectively.

The ideal candidates bring hands-on vulnerability management experience, strong technical troubleshooting skills, and the ability to collaborate with application owners, infrastructure teams, vendors, and risk partners to drive vulnerabilities through resolution.

The Opportunity

As an Infrastructure Security Vulnerability Engineer, you’ll play a critical role in reducing the organization’s technology risk by managing vulnerability remediation activities from identification through closure. You’ll analyze findings from vulnerability assessment tools, evaluate risk and exposure, coordinate remediation plans, and track progress through established systems of record.

You’ll work closely with application managers, infrastructure teams, vendor managers, and risk partners to ensure vulnerabilities are prioritized appropriately and remediated within required time frames. You’ll also use cloud-based AI tools and established security practices to support vulnerability identification, improve remediation workflows, and contribute to reporting and continuous process improvement.

This role is ideal for a security professional who combines technical vulnerability analysis with strong coordination, communication, and reporting skills in a regulated cloud environment.

Your Mission-Critical Responsibilities

Vulnerability Management & Remediation: Lead and coordinate vulnerability remediation activities across infrastructure and applications, ensuring identified vulnerabilities are tracked, prioritized, and resolved in accordance with established security requirements and remediation timelines.

Exposure-Based Risk Prioritization: Evaluate vulnerabilities using CVE and CVSS data, exploitability, threat intelligence, asset criticality, attack paths, exposure information, and other relevant risk indicators to help determine remediation priorities.

CISA Directive Alignment: Support vulnerability remediation activities aligned with applicable CISA BOD 26-04 requirements and other relevant federal cybersecurity directives, including monitoring remediation progress against required deadlines.

Infrastructure & Application Security: Support vulnerability assessment and remediation across Windows Server 2019 and above, Linux/RHEL 9.x and above, and application environments. Work with technical teams to identify appropriate remediation approaches, including patching, configuration changes, and other corrective actions.

Vulnerability Assessment Tools: Use tools such as Tenable Security Center, Nessus, and Qualys to review vulnerability findings, validate remediation status, identify outstanding exposures, and support ongoing vulnerability management operations.

Application & Infrastructure Team Collaboration: Partner with application owners, application managers, infrastructure teams, vendor managers, and risk partners to communicate findings, clarify remediation requirements, resolve technical or process-related questions, and drive issues to closure.

Tracking & System of Record Management: Maintain accurate vulnerability records in ServiceNow or other designated systems of record. Update remediation status, document actions taken, track outstanding items, and ensure records reflect the current state of identified vulnerabilities.

Patch Management & Change Coordination: Coordinate patching and remediation activities with application and infrastructure teams, following established change management processes and supporting timely, controlled implementation of corrective actions.

Exception Management & Risk Response: Support vulnerability exception management, risk-based remediation decisions, incident-driven response activities, and escalation of overdue or unresolved vulnerabilities to the appropriate stakeholders.

AI-Assisted Vulnerability Analysis: Leverage cloud-based AI tools, where appropriate, to support vulnerability identification, analysis, prioritization, and remediation workflows while applying sound security judgment and established review processes.

Risk Metrics & Reporting: Develop and maintain periodic vulnerability management metrics and reports, including remediation progress, aging vulnerabilities, overdue findings, risk trends, and other indicators used to communicate exposure and remediation…