Staff Vulnerability Management Analyst- AI Automation Security Researcher
UKG · Jackson, MS
$115,100–$165,450from the description
Jun 30, 2026
Jackson, MS
Jul 21, 2026
What this job asks for AI summary
A senior security engineering role focused on finding vulnerabilities through manual source code audits (Java, .NET, Python, JavaScript) and building AI-assisted tooling to automate discovery and remediation at scale. Day-to-day work spans writing proof-of-concept exploits, triaging scanner output, coordinating fixes with development teams, and developing autonomous scanning agents and remediation pipelines. Suited to experienced practitioners who are equally comfortable doing hands-on vulnerability research and writing production automation.
Senior level · 7+ years · Remote · Full-time
“or” means any one of them counts — you don't need all of them.
Posted 10 times — it's one opening, so apply once.
We read this from the posting text with AI. Skim the description below before ruling yourself out.
How this req sits in the market our data
Roughly 1,950 people nationally plausibly meet what this posting asks for (information security analysts). range 1,200–2,950
Applicant volume Moderate — A normal amount of company. The rare requirements below are what will separate a shortlisted application from the rest.
Most people in this occupation already list these. Still required — just not what gets you shortlisted.
What the occupation pays Median $132,021 (middle half $99,961–$167,095). This posting is about at that midpoint.
Estimated from BLS employment for this occupation and area, per-skill prevalence across our listing corpus, and published wage benchmarks — as of Jul 28, 2026. It is a model, not a headcount.
Why we read it this way (10)
This role sits at the intersection of security research/vulnerability management and software engineering — roughly 35% of the work is building AI-powered automation tools (production code, pipelines, agents), which makes 15-1252 Software Developers a credible runner-up. 15-1212 Information Security Analysts was chosen because the primary framing and majority of responsibilities center on vulnerability discovery, triage, and remediation coordination.
The degree requirement states 'Bachelor's degree in Computer Science, Cybersecurity, or equivalent experience' — because equivalent experience is explicitly accepted, this is treated as no hard degree gate.
Source code auditing is required in 'at least two of: Java, C#/.NET, Python, JavaScript/TypeScript, Go, C/C++'. Java is listed as the primary skill with the other languages as alternatives, reflecting that any two of the listed languages satisfy the requirement. Python is separately required for building security tools.
SAST, DAST, and SCA are listed together as a single scanner-familiarity requirement in the required section; they are emitted as one skill with alternatives since the JD treats them as a group.
Cloud security assessment (AWS, GCP, Azure) and Kubernetes appear only under Preferred Qualifications.
FedRAMP and NIST SP 800-53 appear only under Preferred Qualifications.
Claude and MCP servers are mentioned in the role description as the enterprise AI infrastructure available, not as a hard gate — they appear under preferred context rather than a formal requirements section.
Security certifications (OSCP, OSWE, GWAPT, etc.) are listed under Preferred Qualifications and are not emitted as skills since they are credentials rather than named technologies or tools.
Ignored 1 non-technology phrase(s) as skills (responsibilities/concepts, not named tools): NIST SP 800-53.
This posting reads as a fully-remote role, so it was scored against the national candidate pool rather than a single metro.
Read the full posting
The employer publishes the full description on their own site — read it there ↗. Or sign in to read it here — it's free, and it also lets you track this application.