Senior Vulnerability Management, ACAS Response Analyst

This is a fully remote position, open to applicants in Illinois.

📋 Description

• Review and evaluate ACAS vulnerability-scan results submitted by Government civilian personnel.

• Confirm findings and prioritize vulnerabilities based on factors such as severity, exploitability, asset importance, mission impact, exposure, and relevant Government criteria.

• Identify impacted systems, applications, devices, and organizational stakeholders.

• Assign and synchronize remediation efforts with infrastructure, application, operations, engineering, and Government teams.

• Set remediation deadlines and monitor findings through mitigation, approved exceptions, risk acceptance, or confirmed closure.

• Ensure compliance with pertinent IAVAs and IAVM requirements.

• Maintain records of vulnerabilities, remediation statuses, due dates, responsible parties, risk decisions, and supporting documentation.

• Develop and continuously enhance system- or program-level POA&Ms.

• Escalate overdue, high-risk, repeatedly identified, or unresolved vulnerabilities.

• Coordinate Government rescan requests and review rescan results to validate remediation efforts.

• Document vulnerability closures and retain verifiable supporting evidence in the designated Government repository.

• Identify false positives, duplicate findings, accepted risks, operational dependencies, and remediation limitations for Government assessment.

• Review Endpoint Security Solutions reports and facilitate remediation of endpoint-security issues.

• Monitor vulnerability aging, remediation performance, compliance rates, recurring issues, and risk trends.

• Create vulnerability-management reports, metrics, dashboards, risk summaries, and briefing materials.

• Assist with the reporting of USMEPCOM security compliance.

• Coordinate urgent or expedited remediation for critical vulnerabilities and time-sensitive directives.

• Verify that remediation evidence is complete, accurate, and adequate to support closure.

• Suggest process enhancements to boost remediation efficiency, minimize recurring vulnerabilities, and enhance reporting precision.

• Aid in the development and maintenance of vulnerability-management procedures, SOPs, workflows, and user guidelines.

⛳️ Requirements

• Active Secret clearance or higher.

• Bachelor’s degree in Cybersecurity, Information Systems, or a related discipline.

• A minimum of 10 years of relevant experience in cybersecurity, information assurance, vulnerability management, or information security.

• Current CompTIA Security+ certification.

• Current CompTIA Cybersecurity Analyst (CySA+) certification.

• Experience in analyzing ACAS or Tenable vulnerability-scan results within a Department of Defense context.

• Experience in coordinating vulnerability remediation across infrastructure, network, endpoint, application, database, cloud, and system administration teams.

• Knowledge of IAVAs, IAVM requirements, and related reporting protocols.

• Experience in creating and maintaining POA&Ms for cybersecurity vulnerabilities and compliance findings.

• Proficiency in prioritizing vulnerabilities based on severity, exploitability, mission impact, asset criticality, and threat intelligence.

• Experience in coordinating rescans and validating the effectiveness of remediation using scan results and supporting technical documentation.

• Familiarity with Endpoint Security Solutions, STIG Viewer, SCAP tools, eMASS, ServiceNow, or similar cybersecurity and workflow platforms.

• Understanding of the DoD Risk Management Framework, NIST SP 800-53 controls, FISMA reporting, DISA Security Technical Implementation Guides, and applicable DoD cybersecurity directives.

• Experience in developing vulnerability metrics, aging reports, remediation dashboards, compliance summaries, and executive-level presentations.

• Experience in documenting false positives, mitigations, operational constraints, accepted risks, and technical closure evidence.

• Strong analytical, prioritization, documentation, communication, and cross-functional coordination abilities.

• Capability to articulate complex vulnerability findings and remediation risks to both technical and non-technical stakeholders.

🏝️ Benefits

• Comprehensive health insurance coverage.

• Retirement savings plan with employer matching.

• Opportunities for professional development and certification reimbursement.

• Flexible work arrangements and paid time off.