This position is required to be on-site at our Bangalore office 3 days per week
The Principal Engineer - Exposure Management will serve as a senior technical leader and subject matter expert responsible for advancing the organization's Exposure Management capabilities across infrastructure, cloud, applications, containers, and modern technology environments.
The role will be responsible for developing technical standards, procedures, and scalable operational processes for continuously identifying, assessing, validating, prioritizing, and reducing security exposures across internal and client environments.
The Principal Engineer will work closely with Management, Solution Architects, Senior Engineers, Security Engineers, application and cloud teams, other Principal Engineers, and clients to deliver and mature high-profile Managed Security Services.
This individual will provide technical leadership across the entire exposure lifecycle, helping move security programs beyond isolated vulnerability findings toward a risk-based view of exploitable exposure, incorporating technical severity, asset criticality, threat intelligence, business context, cloud posture, application risk, and compensating controls.
The Principal Engineer will also serve as a technical escalation point, mentor engineering staff, drive automation and service improvements, and help establish consistent Exposure Management practices across client environments.
How You'll Make an Impact
- Provide technical leadership for Exposure Management services across infrastructure, endpoints, networks, operating systems, cloud platforms, applications, APIs, containers, Kubernetes, and software dependencies.
- Define and continuously improve the end-to-end Exposure Management lifecycle covering discovery, assessment, validation, contextualization, prioritization, remediation, reporting, and continuous improvement.
- Design and maintain assessment policies, security baselines, scan configurations, credentials, schedules, coverage standards, and technical procedures across supported security platforms.
- Lead the identification and management of security exposures including software vulnerabilities, application weaknesses, cloud misconfigurations, insecure configurations, vulnerable dependencies, exposed services, container risks, and other technology weaknesses.
- Establish risk-based prioritization methodologies that consider factors such as severity, exploitability, active exploitation, asset criticality, external exposure, business impact, application context, threat intelligence, and available compensating controls.
- Analyze and validate security findings to improve accuracy, eliminate false positives and duplicate findings, identify systemic risk, and ensure remediation efforts focus on meaningful security exposures.
- Work closely with infrastructure, cloud, application, DevOps, networking, platform, and security teams to translate exposure findings into clear and actionable remediation activities.
- Provide technical leadership for enterprise security assessment technologies and capabilities including network and agent scanning, credentialed assessments, cloud posture assessment, application security testing, dependency analysis, container security, API security, and Infrastructure-as-Code security.
- Support the integration of security assessments into modern engineering and DevSecOps workflows, helping identify and remediate exposures earlier in the technology and application lifecycle.
- Define and maintain technical integrations between Exposure Management technologies and enterprise platforms such as SIEM, SOAR, ITSM, CMDB, CI/CD, asset management, and risk-management systems.
- Develop dashboards and reporting that provide meaningful visibility into overall exposure, remediation progress, aging, coverage, trends, SLA performance, recurring weaknesses, and risk reduction.
- Establish metrics and KPIs that measure the effectiveness and maturity of Exposure Management rather than focusing solely on the volume of vulnerabilities or findings.
- Identify opportunities for automation and orchestration across discovery, enrichment, validation, prioritization, assignment, remediation tracking, exception management, and reporting.
- Lead troubleshooting and resolution of complex issues involving scanning, integrations, assessment coverage, credentials, policies, cloud configurations, application testing, asset identification, and reporting.
- Support the onboarding of new clients, technologies, applications, cloud environments, and security platforms into the Exposure Management service.
- Evaluate emerging Exposure Management technologies and capabilities and provide technical recommendations for service enhancement and technology adoption.
- Develop and maintain engineering standards, operating procedures, runbooks, implementation guides, knowledge articles, and technical documentation.
- Provide technical mentoring and knowledge transfer to engineers and analysts, helping develop deeper expertise across infrastructure, cloud, and application security disciplines.
- Serve as a senior technical advisor during client security reviews, technical workshops, escalations, architecture discussions, and service improvement initiatives.
- Stay current with emerging vulnerabilities, exploitation techniques, application security risks, cloud security threats, attack-surface trends, and evolving Exposure Management practices.
What We're Looking For- 10+ years of relevant cybersecurity experience, with significant experience across vulnerability management, security engineering, cloud security, application security, or related security disciplines.
- 6+ years of hands-on experience implementing, managing, or engineering enterprise security assessment and Exposure Management technologies.
- Strong understanding of the complete vulnerability and exposure lifecycle, including asset discovery, assessment, validation, risk prioritization, remediation, exception management, and measurement.
- Experience assessing diverse enterprise environments including Windows, Linux/Unix, network devices, virtualized infrastructure, AWS, Microsoft Azure, containers, Kubernetes, applications, APIs, and cloud workloads.
- Hands-on experience with enterprise vulnerability or exposure technologies such as Tenable, Qualys, Rapid7, Brinqa, Lumin, Nmap, or equivalent platforms.
- Experience with cloud security and posture-management technologies such as Wiz, Prisma Cloud, Microsoft Defender for Cloud, Orca Security, or equivalent CSPM/CNAPP capabilities.
- Experience with application security capabilities including SAST, DAST, Software Composition Analysis (SCA), API security, secrets detection, container scanning, and Infrastructure-as-Code security.
- Experience with application security technologies such as Checkmarx, Veracode, Snyk, GitHub Advanced Security, Black Duck, Burp Suite Enterprise, or equivalent platforms is desirable.
- Strong understanding of risk-based prioritization and the ability to combine vulnerability severity with asset importance, exploitability, exposure, threat intelligence, business context, and compensating controls.
- Understanding of industry security standards and frameworks including CVE, CVSS, CWE, CISA KEV, OWASP Top 10, CIS Benchmarks, NIST, ISO 27001, SOC 2, and PCI DSS.
- Experience establishing metrics and dashboards capable of communicating technical risk, remediation progress, coverage, service performance, and security posture to both technical and executive audiences.
- Experience integrating security platforms with technologies such as ITSM, SIEM, SOAR, CMDB, CI/CD, asset inventory, and reporting platforms.
- Strong analytical and troubleshooting skills with the ability to work across complex and heterogeneous enterprise environments.
- Ability to translate large volumes of technical security findings into prioritized, actionable risk-reduction activities.
- Strong understanding of security architecture, networking, cloud architectures, modern application architectures, containers, DevOps, and enterprise infrastructure.
- Demonstrated ability to lead complex technical initiatives and provide technical direction to engineers without requiring direct management responsibility.
- Ability to foster collaborative working relationships across Security, Infrastructure, Cloud, Application Development, DevOps, Architecture, and business stakeholders.
- Strong client-facing communication skills with the ability to explain technical exposure and risk to both engineering and leadership audiences.
- Excellent written and verbal communication skills.
#LI-AJ1
What you can expect from Optiv- A company committed to our inclusive value through our Employee Resource Groups
- Work/life balance
- Professional training resources
- Creative problem-solving and the ability to tackle unique, complex projects
- Volunteer Opportunities. "Optiv Chips In" encourages employees to volunteer and engage with their teams and communities.
- The ability and technology necessary to productively work remotely/from home (where applicable)
EEO StatementOptiv is an equal opportunity employer. All qualified applicants for employment will be considered without regard to race, color, religion, sex, gender identity or expression, sexual orientation, pregnancy, age 40 and over, marital status, genetic information, national origin, status as an individual with a disability, military or veteran status, or any other basis protected by federal, state, or local law.
Optiv respects your privacy. By providing your information through this page or applying for a job at Optiv, you acknowledge that Optiv will collect, use, and process your information, which may include personal information and sensitive personal information, in connection with Optiv's selection and recruitment activities. For additional details on how Optiv uses and protects your personal information in the application process, click here to view our Applicant Privacy Notice. If you sign up to receive notifications of job postings, you may unsubscribe at any time.
