Cloud Security Vulnerability Management Program Specialist

At Bank of America, we are guided by a common purpose to help make financial lives better through the power of every connection. We do this by driving Responsible Growth and delivering for our clients, teammates, communities and shareholders every day.

Being a Great Place to Work is core to how we drive Responsible Growth. This includes our commitment to being an inclusive workplace, attracting and developing exceptional talent, supporting our teammates’ physical, emotional, and financial wellness, recognizing and rewarding performance, and how we make an impact in the communities we serve.

Bank of America is committed to an in-office culture with specific requirements for office-based attendance and which allows for an appropriate level of flexibility for our teammates and businesses based on role-specific considerations.

At Bank of America, you can build a successful career with opportunities to learn, grow, and make an impact. Join us!

The Role

We are seeking a skilled and motivated Cloud Security Vulnerability Management Program Specialist to support the Cloud Security Assurance (CSA) organization by ensuring enterprise cloud workloads are securely configured, continuously monitored, and protected throughout their runtime lifecycle.

This role is focused on identifying workload-level vulnerabilities, insecure configurations, and runtime behaviors that could expose systems to compromise, service disruption, or unauthorized access across hybrid and multi-cloud environments.

The Cloud Security Vulnerability Management Program Specialist is responsible for maintaining visibility into workload security posture across virtual machines, containers, and supporting compute services. This includes vulnerability assessment, configuration validation, and runtime monitoring to detect drift from defined security baselines and identify suspicious or policy-violating activity.

The role requires strong understanding of cloud workload architectures, operating system security fundamentals, and shared responsibility models to accurately assess risk and prioritize remediation.

This role partners closely with infrastructure, platform, engineering, and operations teams to ensure vulnerability findings are actionable, risk-assessed, and remediated appropriately.

The Cloud Security Vulnerability Management Program Specialist plays a critical role in strengthening workload security maturity by operationalizing Cloud Security tooling, supporting audit and regulatory requirements, and providing leadership with transparent, risk-based reporting on workload security posture.

The Cloud Security Vulnerability Management Program Specialist operates in fast-paced, enterprise-scale environments and contributes to the development and maintenance of workload security standards, baselines, and documentation that support consistent governance and assurance across all in-scope compute platforms.

Job Responsibilities

• Ensure cloud workloads are protected and monitored in alignment with CSA security standards and defined baselines.
• Maintain continuous visibility into workload security posture across virtual machines, containers, and compute platforms.
• Identify workload vulnerabilities, misconfigurations, and insecure operating system or platform settings.
• Monitor runtime activity to detect suspicious behavior, privilege escalation, policy violations, and drift from security baselines.
• Build, maintain, and tune vulnerability detections aligned to vulnerability management and runtime protection requirements.
• Support onboarding and operationalization of cloud security tooling across environments and workload types.
• Partner with infrastructure, DevOps, and platform teams to drive remediation of workload security risks.
• Triage vulnerability findings, assess risk and impact, and support prioritization of remediation efforts.
• Provide workload security posture reporting, metrics, and risk transparency to CSA leadership.
• Contribute to workload security standards, baseline documentation, and audit readiness activities.

Required Qualifications

• Understanding of Cloud Native security concepts and runtime security principles.
• Experience identifying and managing workload vulnerabilities and insecure configurations.
• Knowledge of cloud compute services, operating systems, and containerized workloads.
• Familiarity with vulnerability management and runtime detection techniques.
• Strong analytical, documentation, and collaboration skills.

Desired Qualifications

• Experience supporting cloud or workload security assurance programs.
• Hands-on experience with Cloud Security Vulnerability Management tools (e.g., Aqua, Prisma Cloud, Wiz, Defender).
• Familiarity with Linux security fundamentals.
• Experience supporting audit or compliance-driven security reviews.
• Bachelor’s degree in a technical or security-related field.
• Relevant cloud or security certifications preferred.

This job will be open and accepting applications for a minimum of seven days from the date it was posted

Shift

1st shift (United States of America)

Hours Per Week

40

Pay Transparency details

• US
• CO
• Denver - 1144 15th St
• Denver Gis (CO9926), US
• DC
• Washington - 1800 K St NW - 1800 K Street NW (DC1842), US
• IL
• Chicago - 540 W Madison St
• Bank Of America Plaza (IL4540)

Pay and benefits information

Pay range

$100,000.00 - $141,300.00 annualized salary, offers to be determined based on experience, education and skill set.

Discretionary incentive eligible

This role is eligible to participate in the annual discretionary plan. Employees are eligible for an annual discretionary award based on their overall individual performance results and behaviors, the performance and contributions of their line of business and/or group; and the overall success of the Company.

Benefits

This role is currently benefits eligible. We provide industry-leading benefits, access to paid time off, resources and support to our employees so they can make a genuine impact and contribute to the sustainable growth of our business and the communities we serve.