Lead Security Engineer - Vulnerability Response (Imunify360)

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Lead Security Engineer – Vulnerability Response (Imunify360) based in United Kingdom. We are seeking a security engineering leader to build and own an AI-assisted vulnerability response pipeline that protects websites against critical threats before attackers can widely exploit them. In this role, you will combine deep web application security expertise with automation, threat analysis, and practical product thinking to accelerate vulnerability detection, validation, and protection. You will extend existing WordPress security automation to ModSecurity and Coraza Web Application Firewall (WAF) rules, ensuring new defenses are accurate, tested, and production-ready. You will also lead a small team of security analysts and collaborate with automation, QA, and marketing to streamline the journey from vulnerability disclosure to protection and public advisory. Success will be measured by faster time-to-protection, broader coverage of critical vulnerabilities, and consistently low false-positive rates. This is an opportunity to shape an AI-driven security capability in a remote-first environment where technical ownership, rapid response, and customer protection are paramount. Accountabilities - Own the vulnerability response pipeline: Design, build, and operate an end-to-end workflow covering vulnerability intake, triage, analysis, AI-assisted rule generation, testing, release, and public disclosure. - Expand automated WAF protection: Extend the existing AI-assisted vulnerability response pipeline from WordPress plugin protection to ModSecurity and Coraza WAF rules.

- Develop and maintain security rules: Write, review, and refine ModSecurity/SecLang rules to detect and mitigate real-world web application vulnerabilities and attack patterns. - Validate protection before release: Build automated test harnesses that evaluate rules against known exploits, representative traffic, and legitimate requests to minimize false positives and avoid disrupting customer websites. - Integrate AI into security workflows: Use AI and large language model (LLM) tools to accelerate vulnerability analysis and rule generation, while implementing validation processes to ensure the accuracy and reliability of generated outputs. - Lead and mentor security analysts: Manage priorities, review technical work, support professional development, and remove blockers to help the team deliver effective protection quickly. - Measure and improve outcomes: Define, monitor, and continuously improve key performance indicators, including time-to-protection, critical vulnerability coverage, and false-positive rates. - Automate security advisories: Integrate public advisory generation into the vulnerability response pipeline and collaborate with marketing to establish appropriate formats, review processes, and publication workflows. - Analyze vulnerabilities and exploits: Interpret vulnerability disclosures, advisories, and source code changes to understand exploit mechanisms and translate findings into effective defensive rules. - Balance speed and precision: Make informed decisions under time pressure while ensuring that new security controls protect customers without blocking legitimate traffic. - Drive continuous improvement: Identify bottlenecks across the response process, improve automation and testing, and ensure the pipeline evolves with emerging threats and customer needs. Requirements - At least 5 years of experience in web or application security , including vulnerability research, detection engineering, WAF engineering, or a closely related field.