Purple Team Engineer – Risk & Exposure Management

Role overview

Responsibilities

• Correlate vulnerability management, red and purple team exercises, threat intelligence, exploit trends, and attack surface data.
• Prioritize real-world exploitable risks rather than theoretical vulnerabilities.
• Model attack paths across identity, cloud, network, and endpoint assets.
• Partner with red and blue teams to assess attack technique likelihood and impact.
• Align technical findings with enterprise risk tolerance and support risk scoring and reporting, including CVSS, exploitability, and business context.
• Communicate risk posture to security leadership, GRC and compliance teams, and engineering and infrastructure owners.
• Track remediation progress and residual risk; influence security investments based on risk reduction outcomes.

Required qualifications

• 5–8+ years in security operations, threat modeling, or risk management.
• Strong understanding of MITRE ATT&CK adversary tradecraft, vulnerability management and exploit lifecycles, and security control impact on risk reduction.
• Experience translating technical security findings into business risk.
• Strong analytical and communication skills.

Preferred qualifications

• Experience with attack surface management or breach and attack simulation tools.
• Experience with FAIR or similar risk quantification models and cloud risk management across AWS, Azure, or GCP.
• Background in purple teaming, red teaming, or detection engineering.
• CISSP, CRISC, GCIH, or threat-focused credentials are preferred.

Why join

• Work with a global healthcare company and a growing cybersecurity organization on enterprise-scale security challenges.
• The company describes learning, mentorship, and career development opportunities in a collaborative culture.