Vultr

Full-stack Engineer

• Lead and develop a distributed team of 8+ engineers across Identity Management, Payments & Billing, and Internal Admin Platform; spanning junior to senior-level talent
• Drive engineering execution: sprint planning, technical prioritization, and delivery across multiple concurrent workstreams
• Engage deeply with the PHP monolith; code reviewing, architectural decision-making, and guiding incremental modernization without disrupting production systems
• Build and maintain a high-performance team culture through 1:1s, career development, and structured feedback loops
• Partner closely with product, design, and adjacent engineering leadership to align on roadmap priorities and technical strategy
• Develop team processes that balance velocity, quality, and operational stability at scale
• Own hiring and headcount planning for your teams, including defining roles and evaluating candidates
• Perform technical risk assessments and guide teams through complex system changes; including IAM/SCIM integrations, billing infrastructure, and account lifecycle work

Software Engineer Manager

Backend Engineer

• Lead and grow a high-performing team of storage engineers and operators across multiple regions
• Own the technical delivery for Vultr's block, object, and file storage products across all performance tiers
• Drive architecture decisions for multi-tenant, multi-tier storage platforms serving diverse workload profiles
• Ensure five-nines availability, durability, and performance SLAs across the global storage fleet
• Integrate and operationalize third-party storage solutions as needed
• Optimize storage systems for AI and HPC workloads requiring extreme throughput and low latency
• Collaborate with product, infrastructure, and customer success teams to define storage offerings and SLAs
• Manage capacity planning, cost optimization, and vendor relationships across the storage stack

Senior Manager, Cloud Storage Engineering

Risk

• Conduct in-depth technical security assessments of new and existing vendors using standardized questionnaires (SIG, CAIQ, custom frameworks).
• Validate that vendor-submitted controls align with industry standards including NIST CSF, ISO 27001, SOC 2, CIS Controls, and applicable regulations (GDPR, DORA, HIPAA, PCI-DSS).
• Review evidence packages including penetration test reports, vulnerability scans, audit logs, and attestations.
• Assess network architecture, encryption standards, access controls, patch management practices, and identity management implementations.
• Operate and interpret third-party security rating platforms (e.g., ArgosRisk, DocuBark, etc.) to track changes in vendor risk posture.
• Monitor vendors attack surfaces for newly exposed assets, misconfigurations, and known vulnerabilities (CVEs/zero-days).
• Configure and manage automated alerts for changes in vendor security ratings, breach disclosures, or threat intelligence signals.
• Perform periodic reassessments on a cadence aligned to vendor risk tier (Tier 1: quarterly, Tier 2: semi-annual, Tier 3: annual).
• Collect, review, and validate supporting evidence for vendor control claims.
• Analyze SOC 1 / SOC 2 Type II reports, noting exceptions, qualified opinions, and control gaps.
• Verify currency and scope of ISO 27001, PCI-DSS, HIPAA, and other certifications.
• Maintain audit-ready documentation for each vendor within the GRC platform.
• Monitor vendor breach disclosures and assess organizational impact from third-party security incidents.
• Coordinate with internal Incident Response (IR) and Security Operations Center (SOC) teams when a vendor is compromised.
• Track open findings, remediation commitments, and validate closure through re-assessment.
• Escalate unresolved high-severity findings to risk owners and senior management.
• Assign, maintain, and update technical risk scores for each vendor based on assessment findings and monitoring signals.
• Weight risk findings by vendor criticality — factoring in data sensitivity, operational dependency, and regulatory exposure.
• Contribute technical risk inputs to overall vendor risk ratings within the GRC/TPRM platform.
• Produce executive-ready dashboards, risk summaries, and periodic reports for senior leadership and risk committees.
• Identify and map key sub-processors and technology dependencies for critical vendors.
• Assess concentration risk — flagging cases where multiple vendors rely on the same cloud provider, data center, or software stack.
• Require vendors to notify of material sub-processor changes and reassess impacted risk profiles accordingly.
• Issue formal technical findings report to vendors with clear, prioritized remediation guidance.
• Define remediation timelines, escalation thresholds, and acceptable compensating controls.
• Validate remediation effectiveness through follow-up evidence collection and re-testing.
• Escalate non-compliant or unresponsive vendors to procurement, legal, or executive stakeholders.
• Partner with Procurement, Legal, Compliance, and Business Owners on vendor onboarding and renewal decisions.
• Translate complex technical findings into clear, business-oriented risk narratives for non-technical stakeholders.
• Advice on security contract clauses, SLAs, right-to-audit provisions, and breach notification terms.
• Support internal audit, regulatory exams, and external assessments requiring third-party risk evidence.
• Continuously refine assessment questionnaires, technical benchmarks, and monitoring playbooks.
• Stay current on emerging threats, regulatory changes, and evolving industry standards relevant to vendor risk.
• Contribute to the development and refinement of vendor tiering models and organizational risk appetite definitions.
• Evaluate and recommend new tools or capabilities to strengthen the TPRM monitoring program.

Third Party Risk Specialist

Recruitment

• Draft, post, and manage job descriptions in partnership with hiring managers and the Talent Acquisition team.
• Screen and triage incoming resumes and applications to identify qualified candidates.
• Coordinate and schedule interviews across multiple time zones, ensuring a seamless experience for all parties.
• Prepare and send offer letters and employment agreements in alignment with company guidelines.
• Conduct reference checks and background checks as required.
• Maintain data integrity within the Applicant Tracking System (ATS) by ensuring all candidate information, workflows, and documentation are up to date. ATS is Ashby.
• Build, update, and maintain recruitment dashboards to support data-driven decision-making.
• Contribute to continuous improvement initiatives by identifying process gaps and recommending operational improvements.
• Ensure compliance with company policies and applicable employment laws throughout the recruitment process.

Talent Acquisition Coordinator

Manager

• Team Leadership: Manage and mentor a team of skilled analysts, overseeing performance, career development, and daily operational priorities.
• Remediation Leadership: Partner with internal stakeholders to drive completion on complex remediation efforts, negotiate priorities and timelines, escalate blocked remediations, and maintain a risk-based approach to remediation prioritization.
• Continuous Improvement: Identify opportunities for improvement, benchmark program maturity against industry frameworks, solicit feedback from internal stakeholders to improve remediation procedures, and incorporate lessons learned into policies and procedures.
• Audit and Compliance Support: Serve as subject matter expert in internal and external audits, providing remediation evidence and policy attestations, and translate audit findings into actionable remediation plans.
• Vulnerability Management Oversight: Serve as the primary vulnerability management authority during security incidents and security operational engagements.

Software Engineer Manager

Senior Manager, Cloud Storage Engineering

Third Party Risk Specialist

Talent Acquisition Coordinator

Manager, Vulnerability Management