Security Engineer - Vulnerability Management

About the job

Meta protects billions of people, and at our scale, vulnerabilities can't be managed by hand. As a Security Engineer on the Scaling – Vulnerability Management team, you'll build ML-based systems that automate how vulnerabilities are identified, triaged, and remediated across Meta's codebase. You'll design autonomous remediation pipelines and AI agents (like Viper and FixieAI) that cut through noise, surface real risk, and patch issues at a scale manual review can't reach — while building the supply-chain defenses (package mirrors, metadata services, and orchestration via VMMC) that keep automated upgrades safe. It's a chance to turn vulnerability management from a reactive queue into a proactive, automated defense.

Responsibilities

Design and build AI-powered autonomous remediation pipelines that detect and patch third-party library vulnerabilities across Meta's codebase, scaling from thousands to hundreds of thousands of packages. Develop ML-driven triage and contextualization agents (e.g., Viper Assist, FixieAI) that autonomously assess, prioritize, and suppress vulnerability tasks with high precision — compressing remediation queues down to real, actionable risk. Architect supply-chain defense systems, including time-locked package mirrors, quarantine mechanisms, and package decoration services that enrich dependency metadata for safer automated upgrades. Drive cross-functional strategy across security, infrastructure, and product engineering teams, defining processes that enable multiple teams to operate at scale with automation. Identify and solve ambiguous, open-ended problems where the solution is not initially known — owning technically complex workstreams while enabling others to execute.