Vulnerability Management Engineer (Qualys)

Salary: ₱70,000 – ₱85,000 per month

What You’ll Own

• Full lifecycle administration of Qualys VMDR in a large enterprise environment, including scanner appliance management, scan policy design, asset tagging, exclusion management, and scan scheduling across cloud and on-premises infrastructure.

• Maintain and optimize scan coverage across dynamic asset groups, including cloud workloads in AWS, Azure, and GCP, as well as endpoints, servers, and network devices.

• Manage Qualys Cloud Agent deployment, health monitoring, and lifecycle across Windows, macOS, and Linux endpoints through MDM and EDR integrations.

• Own the vulnerability data pipeline from scan output to prioritized findings delivered to engineering and IT owners with clear SLA expectations.

• Develop and maintain dashboards and reports in Qualys TruRisk, along with custom reporting for CISO, risk, and compliance stakeholders.

• Integrate Qualys with SIEM, ITSM, and AI orchestration tooling to enable downstream automation and ticketing workflows, including Splunk and ServiceNow.

• Perform exception and false-positive management with documented risk acceptance tied to business justification.

• Support OCC and FFIEC audit and examination requirements with scan evidence, remediation metrics, and control documentation.

Where You’ll Push Forward

• Build Python-based automation for routine Qualys administration, including bulk tag operations, scan scheduling changes, asset-group reconciliation, stale-agent cleanup, and API-driven reporting.

• Develop integrations between Qualys APIs and the team’s AI pipeline to enable intelligent triage, auto-escalation, and patch-prioritization recommendations.

• Contribute to the team’s 40+ AI agent portfolio by designing a Qualys-specific agent layer that interprets scan output, enriches findings with threat-intelligence context, and routes tickets autonomously.

• Identify and eliminate manual touchpoints across the vulnerability-management lifecycle. Success is measured by toil eliminated, not ticket throughput.

• Collaborate with Application Security and Zero Trust teams to align VMDR findings with broader security-posture initiatives.

What You Bring

• 4+ years of hands-on Qualys administration in an enterprise environment with at least 2,000 assets.

• Deep working knowledge of Qualys VMDR, including policy tuning, scanner-infrastructure management, and interpretation of TruRisk scoring.

• Proficiency with the Qualys API and experience building automation against it, preferably using Python.

• Solid understanding of vulnerability-prioritization frameworks, including CVSS, EPSS, and CISA KEV, and how to apply them in a risk-based remediation program.

• Experience integrating Qualys with at least one downstream system such as ServiceNow, Splunk, or Jira.

• Familiarity with cloud asset discovery across AWS, Azure, or GCP.

• Genuine enthusiasm for AI-assisted workflows, including comfort with prompt engineering, API integrations, and identifying routine judgment calls that AI agents can perform.

Bonus Points

• Qualys Certified Specialist certification in VMDR or the Qualys Platform.

• Prior work in a regulated industry such as financial services or healthcare