Vulnerability Engineer (with AI)

Location: New York City, NY

Experience: 5+ years

Work Mode: Onsite – NYC

Job Description:

• Programming: Strong Python (scanners, orchestration, API integration); basic Bash for CI/CD glue
• Source & Artifact Systems: GitHub (Actions, Advanced Security, PR workflows) and JFrog Artifactory/Xray; ability to scale across multi-repo, multi-language codebases
• Scanning Tools: Hands-on with Snyk, Xray, CodeQL / Dependabot, Trivy, or Semgrep; understanding of CVE/CVSS scoring and EOL-detection sources (e.g., endoflife.date)
• AI-Driven Remediation: Building agentic workflows (LLM-based) that interpret findings, generate patch PRs, run tests, and summarize fixes; prompt engineering for code-editing agents
• - Machine learning and Deep Learning experience
• - Deep understanding of Software Development Life Cycle (SDLC)
• - Good understanding of software and software process vulnerability analysis, identification and remediation. Application of AI Agents and ML/DL in that process

• Consultant shall provide the client with services in connection with the CDRR Vulnerability Management Automation initiative using AI tools and techniques sponsored by the NFR Technology group within the Cyber Data Risk & Resilience business area.
• The objective is to automate vulnerability analysis and remediation, correlate vulnerability findings with Hygiene initiatives, provide dashboards and progress tracking, and establish traceability across CVEs, Hygiene projects, End-of-Life releases, and remediation activities. The solution will deliver reusable components, services, and capabilities as part of the Project Helios initiative for CDRR.
• Phase 1 - Analysis and Design: Collect requirements from relevant teams; assess current data and data sources; define workflows, traceability logic, and remediation use cases; and establish the base automation environment, including approved AI toolsets and required access.
• Phase 2 - Build and Validate: Build and validate an automation framework that ingests approved data sources on an agreed schedule, establishes traceability among findings and remediation items, recommends approved remediation paths, and produces enhanced dashboards and automated notifications.
• Phase 3 - User Engagement: Enable application squads to adopt and operationalize the automation framework for remediation activities.
• Phase 4 - Production Go-Live and Transition: Deploy the solution to production, provide post-production hypercare, establish a repeatable operating process, and transition the solution to the Morgan Stanley team.