Information Security Engineer

About the Role

Metro Sys is seeking a skilled Information Security Engineer II to support and lead efforts around vulnerability management within a dynamic, enterprise-scale environment. This individual will be instrumental in identifying and addressing security vulnerabilities across systems, networks, and applications. The ideal candidate brings a deep understanding of vulnerability scanning tools, remediation prioritization, and collaborative risk mitigation strategies.

You will work closely with cross-functional teams to enhance the organization’s security posture and help ensure compliance with industry standards. If you thrive in fast-paced environments and are passionate about cybersecurity, this is an exciting opportunity to grow and make an impact.

• Lead the end-to-end vulnerability management lifecycle
  : scanning, analysis, prioritization, reporting, and remediation tracking.
• Perform regular vulnerability assessments and support remediation efforts in collaboration with infrastructure and application teams.
• Track and assess emerging threats and zero-day vulnerabilities using vendor bulletins and threat intelligence feeds.
• Generate reports and dashboards to communicate risk posture and mitigation progress to technical and executive stakeholders.
• Maintain and optimize vulnerability scanning tools to ensure full visibility and accurate detection across the environment.
• Assist in security incident response involving known or suspected exploited vulnerabilities.
• Support regulatory and compliance audits (e.g.,
  PCI, NIST, HIPAA
  ) by providing documentation and metrics.
• Continuously improve processes, documentation, and tooling in the vulnerability management program.

• Bachelor's degree in Computer Science, Cybersecurity, or a related field (or equivalent experience).
• 3+ years of experience in information security, with a strong emphasis on vulnerability management.
• Hands-on experience with scanning tools (e.g., Tenable, Qualys, Rapid7).
• Solid understanding of network architecture
  , operating systems (Linux, Windows), and web applications
  .
• Familiarity with CVSS scoring
  , risk modeling, and remediation prioritization frameworks.
• Ability to work with scripting or automation tools (Python, Power Shell, Bash) is a plus.
• Excellent communication and problem-solving skills; ability to clearly explain security findings to non-security audiences.
• Experience with compliance frameworks such as PCI DSS, NIST, HIPAA
  , or ISO 27001
  .
• Relevant certifications are a plus (e.g.,
  CISSP, Security+, LFCS, RHCSA
  ).