Lead Vulnerability Management Security Engineer

At Deckers Brands, Together, Every Step is a promise kept that every employee can bring their authentic self, is valued and supported, as a whole person, at work and beyond. Together, Every Step is how we continue to deliver exceptional business results, experience an amazing place to work, and have a positive impact on the communities and world around us. 

Job Title: Vulnerability Management Security Engineer

Reports to: Dir, Security Engineering

Location: United States (Remote)

Interested applicants must reside in one of the following approved states: Arizona, California, Colorado, Indiana, Massachusetts, Minnesota, New York, Oregon, Pennsylvania, Texas, Utah, Washington

The Role

As Lead Vulnerability Management Security Engineer, you will architect the global strategic vision for Deckers Brands' security posture, moving beyond tactical scanning to build a high-maturity, risk-based vulnerability management lifecycle. You’ll serve as a pivotal bridge between technical Infrastructure Operations and cross-functional business leadership, quantifying and mitigating systemic risk. Your mission is to shift the organization from reactive patching to a proactive governance model, implementing advanced prioritization frameworks that balance rapid business innovation with rigorous security stability. By driving the adoption of next-generation automation and orchestration tools, you will ensure that critical assets remain resilient against an evolving global threat landscape while directly influencing the security culture of a growing multi-brand enterprise.

We celebrate diversity--of your background, your experiences and your unique identity. We are committed to ensuring an inclusive and equitable workplace where all of our employees can Come as They Are. We believe that when we bring our different perspectives to work, we are truly Better Together.

Your Impact

• Architect and lead the end-to-end vulnerability management lifecycle, ensuring alignment with global security frameworks such as NIST, ISO 27001/2, and CIS Top 20
• Lead high-level risk discussions with business and technical stakeholders to transform raw vulnerability data into prioritized, actionable remediation roadmaps
• Serve as a trusted security advisor to infrastructure and application teams, fostering a culture of shared accountability for security debt and remediation
• Design and maintain a comprehensive security metrics program using BI tools (e.g., Tableau) to communicate program effectiveness and residual risk to executive leadership
• Drive the strategic selection, integration, and optimization of advanced security technologies to ensure a future-ready defense against emerging threats
• Spearhead the use of Python, PowerShell, and API integrations (with tools like CrowdStrike) to automate repetitive workflows and improve the Mean Time to Remediate (MTTR)
• Own the development and continuous improvement of cybersecurity policies and standards, ensuring they reflect current global threat intelligence and regulatory requirements
• Perform complex, risk-based assessments of both on-premises and cloud-native services to ensure consistent security controls across a hybrid environment
• Build and present compelling technical and business cases for security investments, securing buy-in for initiatives that mitigate critical enterprise vulnerabilities

Who You Are

• BA/BS degree, or equivalent experience
• Security professional certification, such as Global Information Assurance Certifications, Certified Information Systems Security Professional (CISSP), Certified Vulnerability Assessor (CVA), GIAC Enterprise Vulnerability Assessor (GEVA), or other similar credentials, is desired
• Demonstrated success in architecting, implementing, and scaling enterprise-grade vulnerability management programs from the ground up
• 7+ years of extensive experience in security vulnerability management, including sophisticated scanning methodologies, risk-based assessment, and complex remediation orchestration
• Advanced hands-on experience with industry-leading vulnerability management platforms and their integration into the broader security stack
• Deep understanding of mapping vulnerability remediation to regulatory frameworks and standards such as PCI-DSS, HIPAA, SOC2, and GDPR
• Proven ability to author and enforce enterprise security policies, standards, and SLAs that drive measurable risk reductio