B

BeyondTrust

PAM, vulnerability, and endpoint security solutions

Vulnerability Manager

Full-Time
No salary listed
Senior
Remote in USA+1 moreMore locations: Remote in Canada
RemoteMust be based in North America.
CybersecuritySecurity Governance, Risk & Compliance

About the job

Requirements
  • At least 5 years of experience in vulnerability management, product security, or security operations, with direct ownership of a vulnerability management process.
  • Experience designing and operating a vulnerability management process in a regulated or audited environment and sustaining it through assessment cycles.
  • Working knowledge of FedRAMP and NIST SP 800-53, including vulnerability scanning, flaw remediation, continuous monitoring, configuration management, and POA&M management.
  • Hands-on experience operating enterprise vulnerability and exposure management platforms, cloud security posture tooling, container scanning, and software composition analysis.
  • Practical automation skills, including scripting in Python or an equivalent language, workflow and reporting tooling, and AI assistants for triage and reporting.
  • Ability to write clear technical requirements and partner with security engineering through design, delivery, and acceptance.
  • Strong understanding of CVSS, CISA Known Exploited Vulnerabilities, EPSS, and risk-based prioritization.
  • Working knowledge of cloud services, containers, Kubernetes, CI/CD, web applications, and application programming interfaces sufficient to assess findings and proposed fixes.
  • Ability to drive remediation across engineering teams without direct authority.
  • Clear written and verbal communication with engineers, executives, auditors, and customers.
Responsibilities
  • Design and operate the product vulnerability management process end to end, including intake, triage, risk assessment, assignment, SLA tracking, exception handling, and closure verification.
  • Own vulnerability management for FedRAMP 20x, including continuous monitoring cadence, machine-readable evidence, Key Security Indicator reporting, and POA&M lifecycle from creation through closure.
  • Stand up vulnerability management for new products and services by defining scan coverage, onboarding them into the process, setting SLAs, and establishing reporting from first release.
  • Assess and rank vulnerability risk using exploitability, exposure, asset criticality, and compensating controls rather than CVSS alone, and defend the ranking to engineers, executives, and assessors.
  • Drive remediation with product engineering teams by assigning ownership, agreeing timelines, escalating overdue Critical and High findings, and recording time-bound risk acceptances with expiry dates.
  • Automate vulnerability management processes using scripting, workflow tooling, and artificial intelligence-assisted analysis for triage, deduplication, enrichment, summarization, and evidence collection.
  • Define requirements for Security Engineering platform integrations covering scanners, ticketing, asset inventory, and dashboards; partner through delivery and validate results against operational needs.
  • Own program metrics including SLA attainment, mean time to remediate, vulnerability aging, backlog trend, scan and asset coverage, and exception volume, and report them on a fixed cadence to security and engineering leadership.
  • Maintain a current view of critical exposure across the product portfolio and provide the authoritative assessment of what is open, its meaning, and when it will close.
  • Lead rapid response for actively exploited and zero-day vulnerabilities, including exposure assessment across the product fleet, mitigation tracking, and stakeholder communication.
Desired Qualifications
  • Direct experience supporting FedRAMP Moderate or High authorization and continuous monitoring, or FedRAMP 20x.
  • Experience defining metrics and building reporting or dashboards for executive and audit audiences.
  • Experience with SaaS, identity security, or privileged access management products.
  • Familiarity with agentic or artificial intelligence-assisted security workflows.
  • Cloud security certifications such as AWS, Azure, or Google Cloud Platform; GIAC; CISSP; or equivalent.

About the company

B

BeyondTrust

View
cbWebsite

BeyondTrust provides cybersecurity software for organizations. Its products include Privileged Access Management (PAM), which controls and monitors access to critical systems; Vulnerability Management, which finds and helps remediate security weaknesses; and Endpoint Protection, which secures devices from threats. The offerings are delivered as software and managed services, and the company works with large enterprises, government agencies, and partners to provide an integrated security platform. Its goal is to reduce cyber risk by preventing unauthorized access, detecting and fixing weaknesses, and protecting endpoints for safer IT operations.

Company Size

1,001-5,000

Company Stage

Acquired

Total Funding

$12.1M

Headquarters

Johns Creek, Georgia

Founded

1985

Get referred to BeyondTrust

See people who can refer or advise you

Simplify Jobs

Simplify's Take

What believers are saying

  • Black Hat 2026 launch made PathfinderAI, AI Agent Security, and NHI Governance available early.
  • September 2026 CrowdStrike partnership expands distribution and reinforces BeyondTrust inside security operations centers.
  • April 2024 Entitle acquisition and 2026 Pathfinder expansion deepen identity governance and access management.

What critics are saying

  • CVE-2026-1731 hit CISA KEV, exposing unpatched Remote Support and PRA customers.
  • July 2026 patches fixed four vulnerabilities, while nearly 2,000 self-hosted instances stayed exposed.
  • Patent suit SynchroFi v. BeyondTrust began March 2026, adding legal distraction and defense costs.

What makes BeyondTrust unique

  • BeyondTrust's Pathfinder unifies privilege, identity, and non-human governance across one platform.
  • CrowdStrike Falcon integrations embed privilege context directly into SOC workflows, deepening platform relevance.
  • NHI Governance extends PAM into AI agents, service accounts, API keys, and workload identities.

Help us improve and share your feedback! Did you find this helpful?

Benefits

  • Flexible Work Hours
  • Hybrid Work Options

Growth & Insights and Company News

Headcount

6 month growth

17%

1 year growth

17%

2 year growth

21%
Mondial News
Oct 16th, 2026
China-Linked hackers exploit BeyondTrust zero-day to seize control of remote support servers.

China-Linked hackers exploit BeyondTrust zero-day to seize control of remote support servers. Discover more Explore History Taste Euro Foods A sophisticated cyber espionage campaign linked to China has leveraged a zero-day vulnerability in BeyondTrust's remote support software to compromise critical servers worldwide, security researchers report. The newly disclosed exploit allowed threat actors to gain unauthorized control over remote support systems, potentially granting them extensive access to targeted networks. This development underscores the rising risks associated with supply chain and remote access tools, prompting urgent calls for enhanced vigilance and patch management among organizations relying on BeyondTrust solutions. China linked hackers target BeyondTrust zero-day vulnerability to compromise remote support servers. Cybersecurity experts have uncovered a sophisticated campaign linked to threat actors originating from China, leveraging a critical zero-day flaw in BeyondTrust's remote support software. This vulnerability, which remains unpatched, allowed attackers to gain unrestricted access to targeted servers, facilitating lateral movement within corporate networks. With the ability to manipulate remote sessions, the hackers have reportedly stolen sensitive data, deployed malicious payloads, and established persistent backdoors to maintain long-term control of compromised infrastructure. Investigations reveal that the attackers prioritized high-value targets across various sectors, including government agencies and technology firms. Key indicators of compromise include: * Unauthorized remote session initiation with administrator-level privileges * Unexplained network traffic spikes directed toward suspicious IP addresses * Use of advanced evasion techniques to bypass endpoint detection systems Organizations are urged to immediately implement mitigation strategies and monitor for abnormal activity, as the exploitation activity continues to evolve rapidly, heightening the risk to critical infrastructure worldwide. Discover more Book Euro Travel In depth analysis of the exploit techniques and attack vectors used in BeyondTrust breach. The attackers leveraged a previously undisclosed zero-day vulnerability in BeyondTrust's remote support software, exploiting weaknesses in authentication protocols to gain unauthorized access to critical servers. By manipulating this flaw, the threat actors bypassed multiple layers of security controls, enabling stealthy lateral movement within compromised networks. This sophisticated approach included the exploitation of vulnerable API endpoints and carefully crafted payloads designed to evade detection by conventional security tools. The breach underscores a growing trend where adversaries combine zero-day exploits with advanced evasion tactics to maximize their foothold in target environments. The initial breach opened pathways to various attack vectors that facilitated full control over remote support infrastructure. Among the methods employed were: * Phishing campaigns that targeted IT administrators, securing initial credentials needed to deploy exploit code. * Exploitation of insecure configurations within the BeyondTrust Gateway, allowing command execution capabilities. * Use of scheduled tasks and legitimate system tools for persistence and privilege escalation. * Deployment of custom backdoors that maintained communication with command-and-control servers operated by the attackers. These combined tactics not only granted prolonged access but also enabled the hackers to manipulate and extract sensitive data from compromised organizations without immediate detection. Security experts urge immediate patch Deployment and enhanced monitoring to prevent further intrusions. In light of the recent exploitation of the BeyondTrust zero-day vulnerability by China-linked threat actors, cybersecurity experts emphasize the urgent need for organizations to deploy the latest security patches without delay. Failure to do so leaves remote support servers vulnerable to full system takeovers, potentially compromising sensitive data and critical infrastructure. Authorities recommend prioritizing patch management protocols and ensuring that all remote support systems are updated to the newest version immediately to mitigate the risk of further breaches. Beyond patching, experts advocate for enhanced monitoring measures to detect and respond to suspicious activities swiftly. Key recommendations include: * Implementing continuous network traffic analysis to identify abnormal patterns indicating lateral movement or data exfiltration. * Deploying multi-factor authentication on remote access points to strengthen access controls. * Increasing log retention and review frequency for early detection of potential indicators of compromise. By adopting a layered defense approach combining proactive patch application and rigorous monitoring, organizations can better protect themselves against evolving intrusion tactics employed by advanced persistent threat groups. To conclude. As investigations continue, the exploitation of the BeyondTrust zero-day vulnerability by China-linked hackers underscores the growing sophistication and persistence of state-sponsored cyber threats targeting critical remote support infrastructure. Organizations using affected BeyondTrust products are strongly urged to apply the latest security patches and review their network defenses to mitigate potential risks. This incident serves as a stark reminder of the evolving landscape of cybersecurity challenges and the importance of proactive threat detection and response in safeguarding sensitive systems worldwide.

Bulletproof Servers
Oct 16th, 2026
BeyondTrust patches zero-day exploited in attacks since August

BeyondTrust patches zero-day exploited in attacks since August. BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. Remote Support is the company's enterprise-grade support solution that helps IT service desks, help desks, and customer support teams troubleshoot issues remotely. Tracked as CVE-2026-102764, this actively exploited authentication bypass vulnerability lets unprivileged remote attackers perform file operations on unpatched appliances and affects RS 26.2.3 or earlier. BeyondTrust patched the security issue for all Remote Support and Privileged Remote Access SaaS customers on October 8, but self-hosted installations must be patched manually if automatic updates are not enabled. While the company shared limited details about the vulnerability, it said the zero-day was abused in the wild by a suspected China-nexus espionage actor tracked by Mandiant and Google Threat Intelligence Group (GTIG) security researchers as "Armory Castle" (formerly UNC5221) and by cybersecurity firm CrowdStrike as "Warp Panda." According to Mandiant researchers, who spotted the initial attacks, Armory Castle hackers exploited the flaw to gain initial access and escalated to root privileges on compromised devices by enabling Set User ID (SUID) permissions. Next, they deployed new Sawfly web shell and Bareclaw tunneler malware, wiped logs to evade detection, and moved laterally through the victim's network using compromised Administrator credentials by opening remote sessions on downstream systems. "After establishing a foothold through the web shell, the actor elevated from the web service account to root-level control of the appliance host. This gave them access to every credential the appliance stored or brokered and the ability to modify files that survive reboot and configuration reset," Mandiant said. "Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed." Internet threat watchdog Shadowserver tracks over 1,400 BeyondTrust remote support instances exposed online, but it provides no information on how many have already been secured or are honeypots. Armory Castle is known for targeting zero-day vulnerabilities in network edge appliances, including various Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805 and CVE-2024-21887, then CVE-2025-0282) appliances, since at least October 2023 to breach enterprise networks and drop new custom malware. Threat intelligence company Volexity also said in January 2024 that UNC5221 had backdoored more than 2,100 Ivanti appliances using the GiftedVisitor webshell in attacks chaining the CVE-2023-46805 and CVE-2024-21887 zero-days. "In past campaigns, ARMORY CASTLE has conducted widespread and opportunistic exploitation following the public disclosure of vulnerabilities it had exploited selectively as zero-days, racing to infiltrate target organizations before patches are deployed," Mandiant added. "It is possible that we will observe similar widespread exploitation attempts associated with CVE-2026-102764." CVE-2026-102764 is the latest in a string of other BeyondTrust flaws that threat actors have exploited in the wild in recent years. Most recently, attackers exploited another critical remote code execution vulnerability (CVE-2026-1731) affecting Remote Support and Privileged Remote Access appliances to establish WebSocket channels and deploy ransomware. The Chinese state-backed Silk Typhoon hacking group is also believed to have exploited two zero-days (CVE-2024-12356 and CVE-2024-12686) to breach BeyondTrust's systems and use a stolen API key to compromise 17 Remote Support SaaS instances, including the U.S. Treasury Department's instance. In the same campaign, Silk Typhoon has also targeted the Office of Foreign Assets Control (OFAC), which administers U.S. sanctions programs, and the Committee on Foreign Investment in the United States (CFIUS), which reviews foreign investments for national security risks. BeyondTrust provides identity security services to over 20,000 customers worldwide, including government agencies and 75% of Fortune 100 companies.

Healthcare Info Security
Oct 16th, 2026
Zero-Day in BeyondTrust Remote Support appliances exploited.

Zero-Day in BeyondTrust Remote Support appliances exploited. 'Patch ASAP' Before Fix Gets Reverse-Engineered by Other Attackers, Expert Warns Mathew J. Schwartz (euroinfosec) - October 16, 2026 All organizations that use BeyondTrust Remote Support appliances are being urged to immediately install a security update in the wake of in-the-wild attacks. BeyondTrust on Thursday detailed a fix for BeyondTrust Remote Support - formerly known as Bomgar - appliances, used by IT teams to remotely manage endpoints, that it first released on Oct. 8. The Atlanta vendor warned all organizations running self-hosted Remote Support appliances to "immediately" install the fix for the critical vulnerability, tracked as CVE-2026-102764, which can be remotely exploited in all versions of Remote Support up to 26.2.3. The advisory also covers users of Privileged Remote Access appliances, which runs on the same vulnerable code. BeyondTrust said it has no evidence that hackers are attacking its other product, but "out of an abundance of caution, we have released the patch for PRA and recommend self-hosted Privileged Remote Access customers apply it immediately." BeyondTrust said the hackers have used the zero-day vulnerability to attack Remote Support appliances since August. The hacks have the hallmarks of a Chinese government-nexus threat actor tracked as Armory Castle and Warp Panda, and previously as UNC5221. "The actor uses a zero-day selectively against chosen targets, and once the vulnerability is public, the actor typically moves to broad exploitation of every instance still unpatched," it said. "The vulnerability exists within internal components of Remote Support. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could be used to perform file operations on the appliance," the vendor said. BeyondTrust said it patched all SaaS customer instances of both Remote Support and Privileged Remote Access, which it manages, on Oct. 8. In a coordinated vulnerability report, threat intelligence researchers at Google and its Mandiant incident response group said the threat actor specializes in attacking edge appliances, gaining long-term access and using the devices to pivot further into a victim's IT environment (see: Mandiant: Chinese Espionage Tool Embedded in US Systems). Successful exploitation of CVE-2026-102764 "allows an unauthenticated remote attacker to perform file operations on the appliance, which can lead to host-level control and access to every credential the appliance stores or brokers," Google researchers warned. "If you run BeyondTrust Remote Support, you should patch ASAP," said Joe Toomey, vice president of underwriting security for cyber insurance provider Coalition. BeyondTrust said it's withholding full details of the vulnerability to give customers time to patch. Toomey said the clock is ticking. "We are now very much in the area of threat actors who will use an LLM to reverse engineer the patched firmware, identify the vulnerability and build a working exploit, and launch a copycat attack that will likely be far broader than the one that Mandiant attributed to Armory Castle," he said. "Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed," it said. BeyondTrust said it first discovered the exploit of CVE-2026-102764 on Sept. 28, hours after "a separate zero-day campaign against another vendor's edge appliances became public, and Mandiant sent us a brief non-specific note that put the team on alert." BeyondTrust's security team contained the compromise, which dated from Aug. 29, and began studying how it worked. The vendor said it runs a third-party attack-detection platform that ingests signals from customer devices and that it detected signs of the attack, but they were labeled as being a false-positive and not flagged for human review. "To strengthen our ability to detect and respond to similar activity in the future, we are working with the vendor to ensure automated triage tools cannot close high-severity signals independently. We are also using our own agentic hunt platforms to reverify external dispositions before closing them," it said. Mandiant also reviewed the compromise of the self-hosted customer and confirmed BeyondTrust's findings on Sept. 30. Mandiant found that after exploiting CVE-2026-102764, the threat actor attempted to dump credentials stored in the appliance's built-in secrets management database - including passwords, API keys, endpoint credentials - and to download documents for network reconnaissance purposes as well as target other endpoints in the victim's environment. "The threat actor used newly identified custom malware, the Sawfly webshell and the Bareclaw tunneller, to interact with the BeyondTrust device. Additionally, the actor routinely deleted appliance logs and endpoint artifacts to maintain access and evade detection," the Google researchers said. They warned that Armory Castle has a history of switching from very targeted exploits of zero-days to mass exploitation, once knowledge of the vulnerabilities becomes public (see: Chinese Espionage Group Targeting Legacy Ivanti VPN Devices). Executive Editor, DataBreachToday & Europe, ISMG Schwartz is an award-winning journalist with two decades of experience in magazines, newspapers and electronic media. He has covered the information security and privacy sector throughout his career. Before joining Information Security Media Group in 2014, where he now serves as the executive editor, DataBreachToday and for European news coverage, Schwartz was the information security beat reporter for InformationWeek and a frequent contributor to DarkReading, among other publications. He lives in Scotland.

iTWire
Oct 9th, 2026
Forcepoint and BeyondTrust Connect identity risk to data exposure, letting customers revoke risky access with precision.

Forcepoint and BeyondTrust Connect identity risk to data exposure, letting customers revoke risky access with precision. COMPANY NEWS: New integration pairs Forcepoint's AI-native data discovery and classification with BeyondTrust's identity risk detections, revealing the sensitive data behind each risk and revoking one identity's access while the business keeps running * Connect identity and data risk and act. When BeyondTrust detects a compromised user, a service account with too much access or an AI agent behaving oddly, Forcepoint shows the data at stake, allowing customers to revoke that identity's access. * Prioritise the exposures that matter. BeyondTrust maps the inherited entitlements and shadow paths behind each identity's access. Forcepoint ranks those identities by the value of the data they can touch, putting the riskiest exposure first. * Keep everyone else working. Customers remove a targeted identity's access instead of locking down whole systems. AUSTIN and ATLANTA - Oct. 8, 2026 - Global AI data security leader Forcepoint and BeyondTrust, the global leader in privilege-centric identity security protecting Paths to Privilege(TM), today announced the new integration of Forcepoint's AI-native data discovery and classification with BeyondTrust Identity Security Insights(R). The integration is available now and debuts today at BeyondTrust's Go Beyond Chicago customer conference. When BeyondTrust detects risk across a human, machine or AI identity based on behaviour, privilege or compromised credentials, Forcepoint pinpoints the sensitive information that identity can reach and where exposure is greatest as risk changes. Customers can then use Forcepoint controls to immediately cut off that identity's access to the specific records involved, without affecting anyone else's access or work. "With AI agents now doing real work inside the business, blocking autonomous tools isn't an option, and neither is guessing," said Bakshi Kohli, Chief Technology Officer of Forcepoint. "When BeyondTrust tells us an identity looks risky, we already know what data it can get to. Teams can take that one identity's access away and nothing more. That's the precision agentic enterprises ask for today." Security teams often get an identity alert in one console and have to open another to understand the full risk. The flagged identity could be a forgotten test login or an account that can read the customer database, and telling the two apart means checking both systems by hand, one alert at a time. Every minute of manual review is another minute an overprivileged identity or AI agent keeps acting. Turning Identity Alerts into AI Data Security Action Customers now get the data context behind each identity risk, along with the controls to act on it. BeyondTrust Identity Security Insights(R) surfaces risky identities based on behavior, privilege, compromised credentials and relationships among them. Forcepoint Data Security Posture Management (DSPM), part of the company's AI data security solutions, maps that risk to the confidential information within its permissions and provides controls to restrict that access. Compromised identities. A stolen identity is only as dangerous as the access it provides and the data that access puts in reach. When BeyondTrust detects a compromised identity or entitlement, the True Privilege(TM) graph maps the real blast radius: every path that identity can take to privilege, not just the permissions on paper. Forcepoint shows which sensitive records sit at the end of those paths, from personal data to financial records and trade secrets, and lets teams block that credential's access. Service accounts and AI agents with too much access. Machine and AI identities outnumber human users 144-to-1, according to 2026 research from the Cloud Security Alliance, and many carry permissions that haven't been reviewed since they were granted. If BeyondTrust detects risky behavior or excessive privilege associated with a service account or AI agent, teams can use Forcepoint to revoke its access to the sensitive data at risk in one step. The account keeps doing the rest of its job. Too many alerts, too little context. Instead of cross-checking two consoles, customers work from one Forcepoint dashboard that ranks each risky identity by the value of accessible data and shows why that identity was deemed risky. With a clear line of sight from identity and privilege risk to sensitive data, teams investigate faster, focus on critical vulnerabilities and remove or restrict access with targeted precision. "The strongest technology alliances bring together complementary capabilities to solve problems neither side should have to solve in isolation," said David Manks, Vice President of Global Strategic Alliances at BeyondTrust. "Forcepoint's understanding of sensitive data and BeyondTrust's identity and privilege intelligence provide two critical dimensions of risk. Bringing them together helps customers see where risky access creates meaningful exposure and take precise action to protect what matters." Availability The Forcepoint DSPM integration with BeyondTrust Identity Security Insights is available now for customers running both solutions. Customers can get started through their Forcepoint account team. Forcepoint joins BeyondTrust at Go Beyond Chicago on Oct. 8. For more information, visit https://www.forcepoint.com/partners/beyondtrust or https://www.beyondtrust.com/partners/directory/forcepoint.

Yahoo Finance
Oct 8th, 2026
Forcepoint and BeyondTrust link identity risk to data exposure for precision access control

Forcepoint and BeyondTrust have integrated their security platforms to connect identity risk detection with data exposure analysis. The partnership combines BeyondTrust's identity risk detection capabilities with Forcepoint's AI-native data discovery and classification system. When BeyondTrust identifies a compromised user, overprivileged service account, or suspicious AI agent, Forcepoint reveals which sensitive data that identity can access. Customers can then revoke that specific identity's access without affecting other users or disrupting business operations. The integration addresses a growing security challenge: machine and AI identities now outnumber human users 144-to-1, according to 2026 Cloud Security Alliance research. Many carry excessive permissions that haven't been reviewed. The solution provides a unified dashboard ranking risky identities by the value of accessible data. It's now available to customers running both platforms. The integration was unveiled at BeyondTrust's Go Beyond Chicago conference on 8 October.