Compensation: $60k – $120k • 0.05% – 0.2%

Founding Vulnerability & Exposure Management Engineer

Vulnerability Research | Exposure Intelligence | Security Product Engineering

Company: Kodaowl, Inc. Location: Remote — United States Preferred Employment Type: Part-Time / Flexible Engagement Seniority: Senior / Principal-Level Industry: Cybersecurity | Exposure Management | Vulnerability Intelligence | AI-Native SaaS

About Kodaowl

Kodaowl is an early-stage cybersecurity technology company building an AI-native, multi-tenant SaaS platform designed to transform how organizations discover, assess, prioritize, remediate, and validate cybersecurity exposures and risks.

Our platform brings together vulnerability assessment, attack surface visibility, threat and vulnerability intelligence, contextual risk prioritization, remediation workflows, validation, and AI-assisted security analysis.

We believe effective cybersecurity requires more than discovering vulnerabilities or generating severity scores. Organizations need reliable evidence, meaningful context, defensible risk assessments, and actionable intelligence to make informed security decisions.

Our philosophy is simple:

Decide with Evidence. Act with Confidence.

We are building a unified exposure and risk intelligence platform that connects security evidence to measurable risk reduction and continuous assurance.

About the Role

We are seeking a Founding Vulnerability & Exposure Management Engineer with extensive technical knowledge, strong research capabilities, and hands-on experience in vulnerability assessment, exposure management, security intelligence, and cybersecurity product engineering.

This is a foundational technical role that combines cybersecurity research, engineering, product innovation, and security domain leadership.

You will work directly with the founder, application engineers, AI engineers, and cloud architects to help design, evaluate, implement, and continuously improve Kodaowl's vulnerability and exposure management capabilities.

The successful candidate will bring a deep understanding of how vulnerabilities are discovered, validated, correlated, prioritized, remediated, and monitored across complex technology environments.

Equally important, you will conduct ongoing research into emerging vulnerabilities, exploitation techniques, detection technologies, security methodologies, industry developments, and limitations in existing cybersecurity products.

We are looking for someone who can independently investigate complex cybersecurity problems, challenge assumptions, identify opportunities for improvement, and convert research findings into practical engineering recommendations and product capabilities.

This is not a traditional vulnerability analyst, SOC monitoring, or routine scanning position. It is a research-intensive engineering opportunity to help build and shape a commercial cybersecurity platform.

Key Responsibilities

1. Advanced Vulnerability & Exposure Management

Provide deep technical expertise in vulnerability and exposure management across modern enterprise environments.

Responsibilities include:

• Design and continuously improve vulnerability discovery, assessment, prioritization, remediation, and validation methodologies.
• Evaluate vulnerabilities affecting networks, operating systems, applications, APIs, containers, cloud infrastructure, and software components.
• Assess exploitability, attack paths, exposure conditions, technical applicability, and potential business impact.
• Develop methods for distinguishing exploitable exposures from theoretical, non-applicable, or low-confidence findings.
• Improve vulnerability evidence collection, normalization, correlation, deduplication, and lifecycle tracking.
• Establish approaches for handling false positives, compensating controls, accepted risks, and remediation exceptions.
• Contribute to continuous threat exposure management (CTEM) capabilities and exposure reduction strategies.
• Define measurable indicators of security posture, exposure trends, remediation effectiveness, and residual risk.

2. Continuous Cybersecurity Research & Technical Intelligence

Conduct independent, ongoing research to strengthen Kodaowl's cybersecurity knowledge, detection capabilities, and product competitiveness.

Research areas include:

• Newly disclosed vulnerabilities, zero-day threats, and emerging exploitation trends.
• Vulnerability discovery techniques, detection methodologies, and assessment technologies.
• Attack surface management and external exposure discovery.
• Exploitability analysis and vulnerability applicability.
• Emerging attacker techniques, exploitation prerequisites, and defensive implications.
• Cloud, container, Kubernetes, web application, API, and infrastructure security.
• Vulnerability intelligence quality, timeliness, completeness, and reliability.
• Security control effectiveness and exposure reduction methodologies.
• Emerging cybersecurity standards, frameworks, research publications, and technical advisories.

Monitor and critically evaluate authoritative sources, including:

• MITRE CVE and CWE.
• NIST National Vulnerability Database (NVD).
• CISA Known Exploited Vulnerabilities (KEV).
• Exploit Prediction Scoring System (EPSS).
• FIRST CVSS specifications.
• MITRE ATT&CK.
• Vendor security advisories and vulnerability disclosures.
• Relevant security research publications and technical communities.

Research should produce actionable outcomes rather than informational summaries alone.

Expected contributions include technical research briefs, detection improvement proposals, intelligence integration recommendations, product capability assessments, and engineering specifications.

3. Vulnerability Detection Technologies & Scanner Engineering

Research, evaluate, integrate, and improve vulnerability assessment technologies.

Relevant technologies may include:

• Network discovery and assessment: Nmap, Masscan, Naabu.
• Attack surface discovery: Subfinder, DNSX, HTTPX, Katana.
• Vulnerability detection: Nuclei, Nikto, OWASP ZAP.
• Container and software security: Trivy and software composition analysis technologies.
• Application and code security: Semgrep, Gitleaks.
• Infrastructure as Code security: Checkov and related configuration assessment tools.
• Commercial platforms: Tenable, Qualys, Rapid7, Wiz, and comparable cybersecurity technologies.

Responsibilities include:

• Evaluate detection accuracy, coverage, reliability, performance, and operational limitations.
• Research new scanning technologies, assessment methods, and integration opportunities.
• Develop or improve scanner integrations, adapters, and evidence-processing workflows.
• Define consistent vulnerability finding structures across heterogeneous tools.
• Establish scanner testing, benchmarking, and quality assurance methodologies.
• Investigate false positives, false negatives, incomplete evidence, and detection inconsistencies.
• Recommend improvements to scanning efficiency, reliability, and resource utilization.
• Collaborate on secure, authorized, scalable, and tenant-isolated scanning architecture.

The objective is to help Kodaowl build robust and defensible security assessment capabilities rather than merely aggregate scanner outputs.

4. Vulnerability Intelligence & Evidence Correlation

Help design and improve the intelligence capabilities underlying Kodaowl's exposure and risk management platform.

Key responsibilities include:

• Correlate vulnerability findings with CVE, CWE, CVSS, EPSS, KEV, and vendor intelligence.
• Evaluate vulnerability applicability based on affected products, software versions, configurations, and available evidence.
• Develop methodologies for distinguishing confirmed vulnerabilities from suspected or unverified exposures.
• Assess the relevance and confidence of vulnerability intelligence.
• Identify conflicting, outdated, incomplete, or unsupported intelligence.
• Improve asset-to-vulnerability relationships and contextual enrichment.
• Establish evidence provenance, traceability, confidence scoring, and validation requirements.
• Recommend mechanisms for continuously updating vulnerability and threat intelligence.

5. Risk-Based Vulnerability Prioritization & Exposure Analysis

Contribute to the development of sophisticated, evidence-based risk assessment methodologies.

Relevant factors include:

• Vulnerability severity and exploitability.
• Known exploitation and emerging threat activity.
• Internet exposure and attack surface accessibility.
• Asset criticality and business context.
• Vulnerability applicability and evidence confidence.
• Existing controls and compensating safeguards.
• Potential business consequences.
• Remediation complexity and urgency.

Responsibilities include:

• Evaluate risk-scoring methodologies and their technical limitations.
• Develop recommendations for contextual vulnerability prioritization.
• Research approaches to exposure analysis and attack path assessment.
• Identify conditions that may materially increase or decrease risk.
• Help establish transparent, explainable, and reproducible risk assessments.
• Validate risk calculations against realistic cybersecurity scenarios.
• Continuously research opportunities to improve prioritization accuracy and decision usefulness.

6. Remediation, Validation & Security Assurance

Help develop capabilities that connect vulnerability detection with verified security improvement.

Responsibilities include:

• Define remediation and mitigation recommendations.
• Establish technical criteria for validating remediation effectiveness.
• Design rescanning and evidence-comparison methodologies.
• Evaluate compensating controls and alternative risk treatments.
• Develop approaches for tracking vulnerability recurrence and residual exposure.
• Support remediation prioritization and workflow integration.
• Help define measurable exposure reduction and security assurance indicators.
• Contribute to technical and executive reporting methodologies.

7. AI-Powered Vulnerability & Security Intelligence

Collaborate closely with Kodaowl's AI engineering team to develop accurate, explainable, and evidence-grounded cybersecurity intelligence.

Responsibilities include:

• Define domain-specific security knowledge requirements for AI-assisted analysis.
• Evaluate AI-generated vulnerability interpretations, risk assessments, and remediation recommendations.
• Research opportunities for applying LLMs, retrieval-augmented generation, and AI-assisted reasoning to cybersecurity workflows.
• Establish technical evaluation criteria for accuracy, relevance, completeness, and evidence quality.
• Identify hallucinations, unsupported claims, misleading conclusions, and incorrect security interpretations.
• Help design human-verifiable security analysis workflows.
• Develop representative cybersecurity evaluation scenarios and benchmarks.
• Recommend safeguards for sensitive security information, tenant isolation, and AI-assisted decision-making.

The goal is to ensure AI strengthens technical analysis and security decision-making without compromising accuracy, transparency, or trust.

8. Competitive Technology Research & Product Innovation

Continuously evaluate cybersecurity technologies, industry practices, and emerging approaches to exposure and risk management.

Responsibilities include:

• Research capabilities and technical approaches used by established and emerging cybersecurity vendors.
• Evaluate vulnerability management, exposure management, attack surface management, and risk prioritization technologies.
• Identify limitations, capability gaps, and unmet technical requirements.
• Research emerging detection techniques, intelligence models, and automation opportunities.
• Assess opportunities for improving Kodaowl's technical capabilities and differentiation.
• Translate research into product improvement proposals, engineering requirements, and validation criteria.
• Collaborate with product and engineering teams to prioritize improvements based on technical value, customer needs, implementation effort, and operational cost.

Research must be evidence-based, technically defensible, and oriented toward practical product improvement.

9. Security Product Engineering & Technical Collaboration

Work closely with Kodaowl's engineering team to translate cybersecurity expertise into functional product capabilities.

Responsibilities include:

• Define cybersecurity functional and technical requirements.
• Review scanner integration designs and vulnerability data models.
• Collaborate on API integrations, security automation, and evidence-processing pipelines.
• Support the design of secure multi-tenant assessment workflows.
• Develop test cases and acceptance criteria for security features.
• Validate vulnerability findings, risk calculations, and remediation recommendations.
• Investigate technical defects and recommend corrective actions.
• Document security methodologies, technical assumptions, limitations, and research findings.
• Contribute to architectural and product design reviews.

Required Qualifications

• Significant hands-on experience in vulnerability assessment, vulnerability management, exposure management, or security research.
• Deep understanding of network, application, cloud, infrastructure, and software security vulnerabilities.
• Strong knowledge of vulnerability identification, exploitation prerequisites, technical applicability, and remediation.
• Demonstrated experience using vulnerability assessment technologies and analyzing complex security findings.
• Strong understanding of CVE, CVSS, CWE, NVD, CISA KEV, and EPSS.
• Experience with risk-based vulnerability management and exposure prioritization.
• Ability to investigate technical security problems independently and evaluate research findings critically.
• Demonstrated ability to translate cybersecurity knowledge into technical requirements, automation, detection improvements, or product capabilities.
• Understanding of attack surface management, security controls, and vulnerability validation.
• Strong analytical reasoning, technical writing, and communication skills.
• Ability to collaborate with software engineers, cloud architects, and AI engineers.
• Ability to work independently and contribute effectively in an early-stage startup environment.

Preferred Qualifications

• Experience developing cybersecurity products, vulnerability management platforms, or security assessment technologies.
• Background in vulnerability research, detection engineering, or security tooling development.
• Experience with Python, REST APIs, JSON, and security automation.
• Experience building or integrating vulnerability scanner APIs.
• Familiarity with multi-tenant SaaS architectures and secure workload isolation.
• Knowledge of Microsoft Azure, AWS, or other cloud environments.
• Experience with containerized security tools and scalable scanning systems.
• Familiarity with CTEM, attack path analysis, and exposure intelligence.
• Experience conducting comparative technical evaluations of cybersecurity products.
• Familiarity with AI/LLM applications, RAG, and automated security analysis.
• Experience designing technical evaluation frameworks, benchmarks, or detection quality metrics.
• Relevant certifications such as CISSP, OSCP, GIAC, or comparable credentials.

Certifications are beneficial but do not substitute for demonstrated technical knowledge, research capability, and engineering experience.

Research & Engineering Expectations

The successful candidate will be expected to contribute across three complementary areas:

Technical Research: Continuously investigate emerging vulnerabilities, security technologies, intelligence sources, assessment methodologies, and opportunities for improvement.

Engineering Contribution: Translate findings into practical designs, technical specifications, scanner integrations, validation methodologies, and improvements to Kodaowl's security capabilities.

Product Innovation: Identify meaningful gaps in existing approaches and help develop differentiated, technically defensible capabilities that improve exposure visibility, risk assessment, remediation, and security assurance.

Research findings should be supported by credible evidence, documented assumptions, and measurable validation criteria.

What Success Looks Like

Success in this role means helping Kodaowl establish:

• Reliable and technically defensible vulnerability assessment capabilities.
• Strong detection coverage and consistent evidence quality.
• Effective vulnerability intelligence enrichment and correlation.
• Contextual, explainable risk prioritization.
• Meaningful remediation and validation workflows.
• Accurate and trustworthy AI-assisted security analysis.
• Continuous research-driven improvements to platform capabilities.
• A clear connection between cybersecurity research, engineering implementation, and measurable product outcomes.

Engagement & Growth Opportunity

This is an initial part-time opportunity with flexible scheduling, suitable for an experienced cybersecurity professional interested in contributing to the development of an emerging cybersecurity platform.

The role offers substantial technical influence over security methodologies, assessment capabilities, intelligence integration, and product direction.

Responsibilities and involvement may expand as Kodaowl advances through commercialization and customer growth.

Compensation and engagement terms will be discussed based on experience, availability, responsibilities, and the company's stage of development.

Why Join Kodaowl?

Kodaowl offers the opportunity to help build a cybersecurity product at the intersection of vulnerability research, exposure intelligence, security engineering, and artificial intelligence.

You will contribute to more than operational security assessments. Your research, technical judgment, and engineering contributions will help determine how the platform discovers vulnerabilities, evaluates evidence, prioritizes risk, recommends remediation, and validates security outcomes.

We value intellectual curiosity, technical rigor, independent research, evidence-based reasoning, practical engineering, and continuous innovation.

Join Kodaowl in building the next generation of intelligent, evidence-driven vulnerability and exposure management.