Zocdoc: Senior Staff Security Engineer, Vulnerability Management — USA Remote

About Zocdoc

Zocdoc develops technology that helps patients find and book healthcare appointments. Its employer introduction describes both a healthcare marketplace and infrastructure supporting access to care through other search and provider channels. The stated focus is the path from seeking care to obtaining an appointment. Its work includes making booking accessible beyond its own marketplace, connecting patient-facing discovery with the systems used by healthcare providers and other organisations to make available appointments easier to reach.

The position and its setting

Zocdoc lists Senior Staff Security Engineer, Vulnerability Management in USA Remote, under reference 8060755. The details below separate the work described by the employer from essential conditions, preferred experience and practical preparation advice.

• Department: Legal
• Employer listing date: 14 July 2026

Responsibilities and work described

• Zocdoc’s most important asset is our people and our platform
• As a Senior Staff Engineer, Vulnerability Management, you’ll play a meaningful role in strengthening both by architecting and scaling our next-generation vulnerability detection and remediation ecosystem across Compliance, Security, and Engineering
• In this role, you’ll help move our security posture from reactive firefighting to predictive, continuous risk reduction through intelligent automation, deeper full-stack visibility, and faster remediation across infrastructure, containers, and application code
• Owning the technical roadmap for an automated, AI-driven vulnerability scanning platform across cloud infrastructure, container registries, operating systems, and application-layer software
• Building: context-engine models that correlate findings from SAST, DAST, SCA, and cloud posture tooling to determine true runtime exploitability
• Implementation: AI-assisted triage workflows that classify vulnerabilities, reduce false positives, and route validated issues to the right engineering teams
• Leadership: targeted red teaming and collaborative purple teaming exercises to validate exploitable paths and strengthen runtime defenses
• Partnering directly with Software Engineering and DevOps to build automated remediation pipelines, including dependency update pull requests and base-image patching workflows
• Engineering security scanning guardrails into CI/CD pipelines and providing structured telemetry to support continuous compliance and executive risk visibility
• Work: with cutting-edge GenAI tools and technology to analyze findings, improve prioritization, and accelerate remediation workflows

Essential requirements and candidate background

• Personally motivated by building secure, scalable systems that reduce real-world risk at scale
• Autonomous, urgent, and creative, and you love turning noisy security findings into actionable engineering outcomes
• Highly collaborative and energized by working across Security, Compliance, Engineering, and DevOps teams
• Passionate about offensive security, adversarial validation, and understanding how theoretical vulnerabilities translate into operational exposure
• A systems thinker who can connect infrastructure, application security, compliance, and automation into one cohesive program
• The kind of person who enjoys pairing deep technical judgment with practical execution and measurable impact
• Serious about your work, but not about yourself
• Meaningful experience in security engineering, vulnerability management, or software development, with at least 8 years focused on infrastructure, container platforms, and product security
• A track record of writing production-grade automation scripts and building custom security tooling at scale
• Hands-on experience planning or executing offensive security exercises, red teaming, purple teaming, or penetration testing
• Deep experience securing cloud infrastructure and containerized ecosystems using platforms such as AWS, GCP, or Azure, along with Docker and Kubernetes
• Advanced proficiency in Python, Go, or Rust to build automation, integrate scanner APIs, and orchestrate automated patching workflows
• Familiarity: adversarial frameworks, vulnerability scoring systems such as CVSS and EPSS, and common application and infrastructure attack vectors including the OWASP Top 10
• Experience integrating security scanners into CI/CD workflows and using AI or LLM APIs to analyze code or log data for rapid prioritization
• Required: the ability to integrate generative AI tools into daily workflows to automate tasks, foster innovation, and maximize productivity
• Advanced security certifications such as OSCE, OSCP, GXPN, CISSP, or equivalent practical engineering experience are highly valued

Location, schedule and contract conditions

For this overseas or regional listing, confirm work authorisation and any location restrictions with the employer. The location does not establish visa sponsorship or permission to work remotely from India.

• Remote Base Salary Range: $200,000 — $290,000 USD
• Work arrangement: Remote
• Advertised location: USA Remote

Benefits mentioned by the employer

• Flexible work environment
• Unlimited Vacation
• 100% paid employee health benefit options (including medical, dental, and vision)
• 401(k) with employer funded match
• Corporate wellness programs with Headspace and Peloton
• Sabbatical leave (for employees with 5+ years of service)
• Competitive paid parental leave and fertility/family planning reimbursement
• Cell phone reimbursement
• Employee Resource Groups and ZocClubs to promote shared community and belonging
• Great Place to Work Certified
• Zocdoc is committed to fair and equitable compensation practices
• Salary ranges are determined through alignment with market data

Pay and application dates

A verified salary figure is not established in this article. An online estimate for another Senior Staff Security Engineer, Vulnerability Management vacancy is not an offer for reference 8060755; use the employer’s own pay disclosure and recruitment communication.

A closing date is not confirmed in this article. Check the current employer page before submitting: an undated posting can change or be withdrawn.

How to apply to Zocdoc

Applications follow the official employer page linked below.

Open the official Zocdoc posting below and match the title and reference 8060755.

Compare your qualifications and experience with the essential conditions for the USA Remote position, then read the preferred criteria separately.

Prepare an accurate CV and the supporting items requested in that employer’s application. Provide only information and documents you are authorised to share.

Use the employer’s application option, complete the required fields and review the submission. Retain the acknowledgement when one is provided. Job Alerts World does not receive the application.

Practical preparation: Python

Python work is easier to assess through a concrete example than a list of libraries. Explain the problem, the input data, the parts you implemented and how you checked the output. Include a repository or a short technical note when you can share it.

Relevant skills

• Python
• Kubernetes
• CI/CD
• Docker
• AWS
• GCP
• Azure
• APIs
• AI/ML
• LLMs
• Google Cloud
• AI