Threat & Exposure Management Platform Engineer

We are looking for a highly experienced Threat & Exposure Management Platform Engineer to design, build, and operate the data platform and architecture that unifies threat, vulnerability, and exposure signal across the enterprise. This is a foundational, high-impact platform engineering role at the core of our organization's evolution toward a next-generation, AI-enabled security operations capability.

You will own the architecture connecting security tooling, threat intelligence, vulnerability data, and adversary validation results into a single, continuously updated substrate — enabling faster, more accurate, and increasingly automated risk prioritization and response across the business.

This role calls for someone with deep platform engineering expertise and strong architectural judgment , comfortable owning complex, mission-critical systems end-to-end rather than working on isolated components.

Key Responsibilities

• •Data Pipeline Engineering: Design, build, and operate scalable, resilient data pipelines that ingest, normalize, and enrich threat and exposure signals from a wide range of security, IT, and cloud platforms (e.g., vulnerability scanners, EDR/XDR, CSPM, CMDB, threat intelligence feeds, identity systems).
• •Platform Integration: Develop and maintain robust API integrations connecting security tooling, data lakes, and correlation/analytics engines to create a single, unified view of the organization's threat and exposure posture.
• •Correlation Engine Development: Architect and implement correlation logic and data models that link vulnerabilities, threats, assets, and business context to support automated, evidence-based risk prioritization.
• •Data Substrate & Architecture Ownership: Build and evolve the underlying data substrate (schemas, storage layers, streaming infrastructure) that serves as the authoritative source of truth for enterprise risk and exposure data, and own its long-term architectural direction.
• •API & Interface Development: Expose clean, well-documented, secure APIs enabling downstream systems, dashboards, and analyst tooling to consume unified threat and exposure data programmatically.
• •Continuous Exposure Lifecycle Support: Build and operate the platform capabilities that support an ongoing, iterative approach to discovering, prioritizing, and validating exposures across the environment — from initial scoping through to remediation tracking.
• •Adversary-Informed Validation Integration: Integrate outputs from adversary emulation, control validation, and simulation exercises into the correlation engine, enriching risk prioritization with real-world evidence of exploitability and defensive effectiveness.
• •Coverage & Gap Analysis: Architect data models and pipelines that continuously assess defensive coverage against real-world attack techniques, surfacing prioritized gaps for remediation.
• •Operational Reliability: Own the uptime, performance, scalability, and data quality of production pipelines and integrations; implement monitoring, alerting, and self-healing mechanisms.
• •Cross-Platform Normalization: Establish common taxonomies and data standards to reconcile inconsistent data formats, severity scoring, and asset identifiers across heterogeneous security tools.
• •Cross-Functional Collaboration: Partner with security operations, threat intelligence, detection engineering, red/purple team, and data science functions to ensure platform outputs meet operational and analytical needs.
• •Security & Compliance: Ensure all data handling, storage, and access adhere to enterprise security, privacy, and regulatory requirements, given the sensitivity of threat and exposure data.
• •Automation & Scale: Drive automation of data onboarding for new tools and platforms to reduce integration lead time as the environment and tool ecosystem grow.
• •Documentation & Knowledge Transfer: Maintain architecture diagrams, runbooks, and integration documentation to support platform sustainability and team scaling.

Required Skills & Experience

• •Strong architecture skills — demonstrated ability to design end-to-end platform architectures spanning data ingestion, correlation, validation, and delivery layers, with sound judgment on scalability, extensibility, and long-term maintainability.
• •Deep platform engineering expertise — a proven track record owning and operating complex, production-grade security data platforms end-to-end.
• •Hands-on experience building large-scale data pipelines (batch and streaming) using tools such as Kafka, Spark, Airflow, Flink, or equivalent.
• •Strong expertise in API design and development (REST/GraphQL), including authentication, rate limiting, and versioning for high-throughput data.
• •Proven experience integrating heterogeneous security platforms (vulnerability management, EDR/XDR, CSPM, SIEM, CMDB, threat intelligence platforms, simulation/emulation tooling).
• •Strong background in data modeling and correlation engine design — able to reconcile asset, vulnerability, threat, and adversary-behavior data into unified risk views.
• •Practical understanding of how to operationalize an ongoing exposure discovery, prioritization, and validation process within a technical platform.
• •Familiarity with mapping known attacker techniques and behaviors to defensive controls and detection coverage.
• •Familiarity with simulation or emulation-based control validation approaches and how their outputs feed into broader risk models.
• •Proficiency in at least one major programming language (Python, Go, or Java) for pipeline and integration development.
• •Experience with cloud-native data infrastructure (AWS/Azure/GCP), including data lakes, warehouses, and event-driven architectures.
• •Solid understanding of core cybersecurity concepts: vulnerability management, threat intelligence, exposure management, attack surface management, and risk scoring frameworks (e.g., CVSS, EPSS).
• •Experience with database technologies spanning relational, NoSQL, graph, and time-series stores for correlation and attack-path use cases.
• •Strong software engineering fundamentals: CI/CD, infrastructure-as-code, version control, testing, and observability practices.
• •Excellent cross-functional collaboration skills, able to work with security operations, detection engineering, and platform architecture teams in a fast-paced, mission-critical environment.

Preferred Qualifications

• •10+ yrs of experience leading a continuous exposure management program or initiative end-to-end, from architecture through operational rollout.
• •Familiarity with graph-based attack path analysis or asset/risk graphs.
• •Hands-on experience with adversary simulation or emulation frameworks and purple-team tooling.
• •Experience supporting AI/ML-driven security operations or automation-first security initiatives.
• •Relevant certifications (e.g., GIAC, cloud security or data certifications) are a plus but not required in lieu of hands-on expertise.

What We're Looking For

A builder who thrives on architecting and operating complex, high-stakes data platforms — someone equally comfortable in deep technical design discussions and hands-on implementation, who wants to shape the data foundation behind the next generation of automated, intelligence-driven security operations.

Education:

• •Bachelor’s degree/University degree or equivalent experience
• •Master’s degree preferred

This job description provides a high-level review of the types of work performed. Other job-related duties may be assigned as required.

------------------------------------------------------

Job Family Group:

Technology ------------------------------------------------------

Job Family:

Information Security ------------------------------------------------------

Time Type:

Full time ------------------------------------------------------

Primary Location:

Irving Texas United States ------------------------------------------------------

Primary Location Full Time Salary Range:

$156,160.0