Vulnerability & Attack Surface Management Analyst II

The posting, as OpenLoop Health wrote it

ABOUT OPENLOOP

OpenLoop was co-founded by CEO, Dr. Jon Lensing, and COO, Christian Williams, with the vision to bring care anywhere. Our telehealth support solutions are thoughtfully designed to streamline and simplify go-to-market care delivery for companies offering meaningful virtual support to patients across an expansive array of specialties, in all 50 states.

ABOUT THE ROLE

OpenLoop’s mission is to bring care anywhere by powering telehealth solutions at scale. Security Operations at OpenLoop protects patient data, clinical operations, and the systems our partners build on. We handle PHI, we’re subject to HIPAA, and care delivery depends on our systems working.

We’re hiring a Vulnerability & Attack Surface Management Analyst II. Nobody at OpenLoop works on vulnerability management or attack surface management full-time today, so you’ll be the first. You’ll report to the Director of Information Security, who sets strategy and priorities for both programs. You’ll carry out that plan, and we expect you to tell us when the findings suggest the priorities should change.

Some context on where things stand. Our cloud inventory has grown about five times over this year and more than doubled in the last two months. We deployed Wiz eight months ago, and it’s finding far more risk than we currently have people to work. Vulnerability management gets squeezed in around other work, and attack surface management has barely started. We’re also rolling out a platform that lets internal teams publish their own applications, which will grow our external footprint faster than anything else this year.

The program is early. You’ll help build it, with a direction already set. You’ll take a very large set of findings and narrow it to what matters using the risk model we’re putting in place, get fixes shipped through engineering teams across the company, and run attack surface discovery on a regular schedule instead of only when a client asks.

What this role is not: forwarding scanner reports to engineering. You own the fix through verification. It’s also not incident response or forensics (you’ll work with our IR team, but your focus is exposure and remediation), not a GRC role (you’ll help with audits and client reviews, but the day-to-day work is operational), and not a tool evaluation role. The platforms are in place, and the job is getting results from them.

WHAT YOU’LL DO

• Run the vulnerability lifecycle day to day: discovery, validation, prioritization, remediation tracking, verification, and reporting across cloud workloads, containers, code repositories, and endpoints.
• Prioritize by actual risk, not raw CVSS. Apply and improve our risk model, which weighs internet exposure, exploitability (CISA KEV, EPSS), asset criticality, and data sensitivity. When the model needs to change, bring the evidence. When something is being deprioritized, make that visible so the decision is made on purpose.
• Build a reliable asset inventory. Co

[…]
th it will shorten your ramp-up. Also useful: Orca, Prisma Cloud, Defender for Cloud, or Lacework; CrowdStrike Falcon Exposure Management or Spotlight; Tenable, Qualys, or Rapid7 for non-cloud assets.

• Attack surface and asset inventory: external ASM tools and recon methods (DNS, certificate transparency, subdomain and shadow IT discovery), CAASM and inventory platforms such as Axonius or runZero, and SaaS discovery tools.
• Application and edge security: DAST and edge/WAF platforms (Invicti, Burp Suite, Cloudflare, Akamai), and vulnerability disclosure or bug bounty programs (HackerOne, Bugcrowd), including researcher communication, report validation, and duplicate handling.
• Platform and supply chain: hardened or minimal base images (Chainguard, distroless, or an in-house golden image program), Kubernetes and container security at scale (we run GKE and EKS), PaaS/edge hosting such as Vercel, Netlify, or Cloudflare Pages, SBOMs and software supply chain security, and automation connecting scanner APIs to Jira, Slack, or reporting pipelines.
• Regulated environments: experience in healthcare, fintech, or another regulated industry, and hands-on HIPAA, HITRUST, or SOC 2 work, especially providing vulnerability management evidence to auditors and clients.
• Certifications: GCLD, GCPN, GWEB, GSEC, AWS or GCP security specialty, OSCP, or equivalent experience.

WHAT WE OFFER

• Competitive compensation
• Medical, Dental & Vision
• Flexible Spending / Health Savings Accounts
• Generous PTO and hybrid-work flexibility
• 401(k) with Company Match
• Life Insurance, Pet Insurance, and more

OUR COMPANY

We have a relatively flat organizational structure here at OpenLoop. Everyone is encouraged to bring ideas to the table and make things happen. This fits in well with our core values of Autonomy, Competence and Belonging, as we want everyone to feel empowered and supported to do their best work.

Sound like a good fit? We’d love to meet you.