Cisco Meraki
Senior Product Security Engineer - Vulnerability Management - 7+yrs
Be an Early Applicant
The Senior Product Security Engineer manages vulnerabilities, assesses severity, triages issues, and optimizes security processes while collaborating globally.
Who We Are:
As the leader in cloud-managed IT, Cisco connects passionate people to their mission by simplifying the digital workplace. Our impact is driven by the innovative, purposeful, and vibrant people who make up our inclusive community. When technology is intuitive, our customers can focus on what matters!
About The team:
As a member of the Device Trust Assurance team, you will have a substantial impact on the security of millions of Cisco devices all around the world. We are looking for people who are passionate about security and eager to learn the ropes of vulnerability management (reporting, triaging and driving remediation).
About The Role:
The Vulnerability Management Engineer plays a critical role in ensuring the security of our systems by managing and mitigating vulnerabilities. Key responsibilities include reviewing vulnerability scanning reports, assessing severity, and triaging vulnerabilities, along with efficiently managing Jira tickets to facilitate timely remediation or mitigation. This role requires utilizing tools such as Vigiles, yocto CVE scanner to conduct vulnerability scanning and analysis, and implementing a risk-based prioritization method for effective management. Leading process optimization efforts by identifying gaps in the vulnerability management workflow and enhancing program efficiency is also essential.
Collaboration with international security organizations as well as engineering teams is necessary to provide guidance on mitigating and remediating vulnerabilities, identify and report automation bugs, and contribute to solutions that reduce manual workload in the vulnerability management lifecycle. The role involves investigating vulnerability alerts, assessing their impact, and calculating severity scores based on attack complexity. Additional duties include maintaining scanning tools, reviewing CVEs for potential risk exceptions, and guiding teams on security best practices and patch management standards. Flexibility to work across different time zones is crucial for effective global collaboration and system security focusing on vulnerability management across Cisco's core platforms including but not limited to
* IOS-XE network operating systems
* SD-WAN infrastructure and controllers
* Meraki cloud-managed devices
* IIoT/Industrial IoT solutions
Qualifications:
Bonus points:
Why Cisco?
At Cisco, we're revolutionizing how data and infrastructure connect and protect organizations in the AI era - and beyond. We've been innovating fearlessly for 40 years to create solutions that power how humans and technology work together across the physical and digital worlds. These solutions provide customers with unparalleled security, visibility, and insights across the entire digital footprint.
Fueled by the depth and breadth of our technology, we experiment and create meaningful solutions. Add to that our worldwide network of doers and experts, and you'll see that the opportunities to grow and build are limitless. We work as a team, collaborating with empathy to make really big things happen on a global scale. Because our solutions are everywhere, our impact is everywhere.
We are Cisco, and our power starts with you.
As the leader in cloud-managed IT, Cisco connects passionate people to their mission by simplifying the digital workplace. Our impact is driven by the innovative, purposeful, and vibrant people who make up our inclusive community. When technology is intuitive, our customers can focus on what matters!
About The team:
As a member of the Device Trust Assurance team, you will have a substantial impact on the security of millions of Cisco devices all around the world. We are looking for people who are passionate about security and eager to learn the ropes of vulnerability management (reporting, triaging and driving remediation).
About The Role:
The Vulnerability Management Engineer plays a critical role in ensuring the security of our systems by managing and mitigating vulnerabilities. Key responsibilities include reviewing vulnerability scanning reports, assessing severity, and triaging vulnerabilities, along with efficiently managing Jira tickets to facilitate timely remediation or mitigation. This role requires utilizing tools such as Vigiles, yocto CVE scanner to conduct vulnerability scanning and analysis, and implementing a risk-based prioritization method for effective management. Leading process optimization efforts by identifying gaps in the vulnerability management workflow and enhancing program efficiency is also essential.
Collaboration with international security organizations as well as engineering teams is necessary to provide guidance on mitigating and remediating vulnerabilities, identify and report automation bugs, and contribute to solutions that reduce manual workload in the vulnerability management lifecycle. The role involves investigating vulnerability alerts, assessing their impact, and calculating severity scores based on attack complexity. Additional duties include maintaining scanning tools, reviewing CVEs for potential risk exceptions, and guiding teams on security best practices and patch management standards. Flexibility to work across different time zones is crucial for effective global collaboration and system security focusing on vulnerability management across Cisco's core platforms including but not limited to
* IOS-XE network operating systems
* SD-WAN infrastructure and controllers
* Meraki cloud-managed devices
* IIoT/Industrial IoT solutions
Qualifications:
- 7+ years in vulnerability management or network security with strong focus on Cisco technologies
- Experiences in Cisco IOS-XE architecture, including kernel components and security mechanisms
- In-depth knowledge of common Security vulnerabilities (OWASP Top 10, CWE Top 25)
- Proficiency with vulnerability scanning tools (Semgrep, coverity, blackduck, vigiles, yocto cve scanner) and firmware analysis
- Experience with SBOM (Software Bill of Materials) analysis
- Ability to trace through Linux kernel configuration systems (KCONFIG) and interpret Makefiles
- Strong C programming skills and understanding of conditional code compilation
- Experience with scripting languages (Python, Bash) and network analysis tools (Wireshark)
- Proven ability to collaborate effectively across global teams and multiple time zones
- Consistent track record to ship in a dynamic environment
- Experience using Jira and other Atlassian software
Bonus points:
- Cisco security certifications (CCNA/CCNP Security) and cybersecurity credentials (CISSP, CEH) preferred
- Experience with industrial/OT security standards (IEC 62443, NIST Cybersecurity Framework)
- Bachelor's degree in Computer Science, IT, or related field
Why Cisco?
At Cisco, we're revolutionizing how data and infrastructure connect and protect organizations in the AI era - and beyond. We've been innovating fearlessly for 40 years to create solutions that power how humans and technology work together across the physical and digital worlds. These solutions provide customers with unparalleled security, visibility, and insights across the entire digital footprint.
Fueled by the depth and breadth of our technology, we experiment and create meaningful solutions. Add to that our worldwide network of doers and experts, and you'll see that the opportunities to grow and build are limitless. We work as a team, collaborating with empathy to make really big things happen on a global scale. Because our solutions are everywhere, our impact is everywhere.
We are Cisco, and our power starts with you.
Top Skills
Atlassian Software
Bash
Blackduck
Cisco Ios-Xe
Coverity
JIRA
Python
Semgrep
Vigiles
Wireshark
Yocto Cve Scanner
What you need to know about the Kolkata Tech Scene
When considering the industries shaping India's tech scene, gaming might not immediately come to mind. However, in the last decade, increased internet usage and greater access to mobile devices have catapulted the industry to new heights, with Kolkata-based companies like Virtualinfocom, Red Apple Technologies and Digitoonz, at the forefront, driving the design and animation of new gaming titles for players.
