Exposure Management Engineer - Mid-Atlantic region (Remote)

General Description

We are looking for a skilled Exposure Management Engineer to support GuidePoint Security's Mid-Atlantic Exposure Management practice, with a primary focus on deploying, configuring, and operating the Axonius Asset Cloud to power risk-based vulnerability management and cyber asset management for our clients. This role will engage in the development of unified asset inventories, risk-based prioritization models, and automated remediation workflows in Axonius while providing “Wow Them” service to clients and/or internal customers or co-workers.

The Exposure Management Engineer will be required to demonstrate strong asset management, integration, and risk-based vulnerability management skills, lead by influence, and strong business/financial acumen to drive the use of progressive exposure management programs — built on Axonius — that will align the delivery of business objectives and priorities.

About the Mid-Atlantic Exposure Management Practice

The Mid-Atlantic Exposure Management Practice is responsible for helping clients see everything they own and fix what matters most. We build unified, real-time asset inventories and risk-based exposure programs — with the Axonius Asset Cloud at the center — that turn fragmented data from hundreds of security and IT tools into a single, trusted asset model and a prioritized, business-aware remediation backlog.

Our team of exposure management engineers, Axonius platform specialists, and automation developers focuses on cyber asset attack surface management (CAASM), risk-based vulnerability management (RBVM), and exposure prioritization. We partner with client security, IT, infrastructure, and cloud teams to eliminate blind spots, de-duplicate findings across tools, assign asset ownership, and drive measurable risk reduction.

Key focus areas of the practice:

• Deploying and configuring the Axonius Asset Cloud — data connections, asset correlation, and coverage gap analysis
• Configuring risk-based vulnerability management in Axonius — de-duplication, asset criticality, exploitability, and business-context prioritization
• Automating enforcement, ticketing, and remediation workflows using the Axonius query and enforcement engine

Roles and Responsibilities:

Axonius Platform Engineering

• Deploy, configure, and maintain the Axonius Asset Cloud (Cyber Asset Attack Surface Management / exposure platform) across complex hybrid, multi-cloud, and on-premises client environments.
• Design and build data connections (adapters) to onboard data from security, IT, identity, cloud, endpoint, and network sources — EDR, vulnerability scanners, MDM, IdP, CMDB, cloud providers, NGFW, and case management tools — via API.
• Configure and tune the Axonius asset correlation engine so that data from disparate sources resolves into unified, de-duplicated asset records.
• Perform daily operational support, monitoring, and maintenance of the Axonius platform, including adapter health, data freshness, and system performance.
• Work with third parties and client tool owners to ensure the correct data is onboarded, credentialed, and refreshed on the right cadence.

Platform Operations

• Operate and maintain security platforms including vulnerability management, CAASM, and CNAPP tools
• Monitor security findings and support prioritization and remediation workflows
• Assist in platform tuning, configuration optimization, and integration with client environments
• Support onboarding of new assets, applications, and cloud environments into security platforms

Exposure Management Operations

• Review exposure findings and assist with prioritization and remediation tracking
• Help manage remediation workflows with client engineering teams
• Generate operational dashboards and reporting for security leadership
• Assist in maintaining asset inventory coverage and scanning accuracy

Risk-Based Vulnerability Management (Axonius) Configuration

• Configure risk-based vulnerability management (RBVM) in Axonius so that vulnerabilities are prioritized by real-world risk — business impact, exposure, and exploitability — rather than by CVSS score alone.
• Ingest and consolidate vulnerability findings from multiple scanners (e.g., Tenable, Qualys, Rapid7) into Axonius, and configure de-duplication so a single vulnerability reported by different tools is represented once.
• Build and maintain asset criticality ratings and business-context tags in Axonius so prioritization reflects the importance of each asset to the business.
• Configure enrichment of findings with threat intelligence and exploitability signals (e.g., known-exploited, active-in-the-wild) to surface the vulnerabilities attackers are most likely to use.
• Design saved queries and dynamic asset/vulnerability views that isolate high-risk, exposed, mission-critical findings and filter out low-risk noise and items already within SLA.
• Configure risk scoring, severity mapping, and prioritization logic that combine CVSS, exposure (internet-facing vs. isolated), exploit status, asset criticality, and existing mitigating controls.
• Build Axonius Enforcement Center actions to automate remediation workflows — create and route tickets to the correct owner in ServiceNow/Jira, notify teams, and track SLA and patch-window adherence.
• Configure escalation (“fire alarm”) logic and SLA-based rules for critical and zero-day vulnerabilities that require faster-than-standard remediation.
• Build dashboards and reporting that show remediation progress, SLA compliance, risk reduction over time, and coverage — tailored for both operational teams and security leadership.
• Continuously tune prioritization models and reduce alert fatigue so client teams focus effort on the findings that actually reduce risk.

Asset Management (Axonius) Configuration

• Configure Axonius data connections (adapters) across security, IT, cloud, identity, endpoint, and network sources to build a comprehensive, real-time inventory of all assets — devices, users, cloud resources, SaaS, and software.
• Tune the asset correlation and de-duplication engine so records from disparate sources merge into a single trusted asset model the entire team can rely on.
• Configure coverage and gap analysis to automatically surface unmanaged, unknown, or non-compliant assets — e.g., devices missing EDR, endpoints missing an agent, or assets absent from the CMDB.
• Build and maintain asset categorization, tagging, and business-context enrichment (owner, environment, criticality, data sensitivity, location) to power downstream prioritization and ownership.
• Configure asset ownership assignment so every finding maps to an accountable owner, closing the “who owns this?” gap that stalls remediation.
• Establish and maintain data hygiene — adapter scheduling, credential management, field mapping, and data freshness — to keep the inventory accurate and current.
• Configure enforcement actions that keep the inventory and other systems in sync — e.g., push corrected/enriched asset data back into the CMDB, open tickets for coverage gaps, or trigger onboarding of missing agents.
• Build saved queries, dashboards, and reports that give clients continuous visibility into asset inventory, coverage, and policy gaps (comparable to building a unified inventory of tens of thousands of assets).
• Compile and reconcile asset inventories from disparate data sources, applying knowledge of network, cloud, and endpoint technologies commonly used in enterprise environments.
• Partner with SIEM, automation, and security operations teams to leverage Axonius asset data for detections, automation, and exposure analysis.

CNAPP & Cloud Security Support

• Assist with the operation and optimization of CNAPP platforms (e.g., Wiz, Prisma Cloud, Orca)
• Support cloud posture monitoring and exposure analysis
• Assist with investigation of cloud misconfigurations, identity exposures, and attack paths
• Work with senior engineers to onboard new cloud environments

Automation & Integrations

• Develop scripts and automation to improve security workflows
• Build integrations between security tools and ticketing systems
• Automate reporting, vulnerability triage, and remediation tracking
• Use APIs and automation frameworks to reduce manual operational effort
• Use the Axonius Query Language, REST API, and Enforcement Center to automate asset queries, enrichment, ticketing, and remediation actions.

Client Engagement

• Participate in regular operational cadence meetings with clients
• Provide updates on platform findings and remediation progress
• Assist senior engineers in troubleshooting security platform issues
• Contribute to documentation and operational playbooks

Required Experience:

• 3+ years of experience in cybersecurity engineering
• Exposure management or risk-based vulnerability management experience
• Hands-on experience with the Axonius Asset Cloud (or comparable CAASM / asset intelligence platform) — configuring adapters, correlation, queries, and enforcement actions.
• Experience building and maintaining unified asset inventories from disparate security and IT data sources.
• Experience configuring asset criticality, ownership, and business context to drive risk-based prioritization.
• Familiarity with vulnerability management, exposure management, or CNAPP platforms such as Tenable, Qualys, Rapid7, Wiz, Axonius, or similar tools
• Scripting experience (Python, PowerShell, or similar)
• Experience working with APIs or automating workflows
• Understanding of security fundamentals: vulnerabilities, misconfigurations, identity and access control, security monitoring
• Strong communication skills and ability to work with engineering teams
• Embraces emerging technologies, including AI tools, to work smarter, solve problems, and drive better business outcomes.

Preferred Experience:

• Experience with CNAPP platforms such as: Wiz, Prisma Cloud, Orca, Lacework
• Experience with cloud platforms: AWS, Azure, GCP
• Familiarity with container security and Kubernetes
• Experience integrating security tools with ticketing platforms (Jira, ServiceNow)
• Direct engineering experience with Axonius adapters, correlation tuning, and the Enforcement Center.
• Experience with cyber asset management (CAASM), asset discovery, and network enumeration tooling.
• Experience in Linux environments and API-based data retrieval from security/infrastructure tools (EDR, IdP, NGFW, cloud providers).
• Experience using AI-assisted tools (LLMs, copilots, or agent frameworks) to accelerate scripting, analysis, and security operations workflows

Travel Requirements:

• Up to 10% travel

Physical Requirements:

• Sedentary work
• Substantial movement of the wrists, hands, and/or fingers for a minimum of 8 hours a day
• Required to have close visual acuity to view computer terminal and/or extensive reading for a minimum of 8 hours a day