Vulnerability Management Analyst

This is a fully remote position, open to applicants in United States.

📋 Description

• Conduct vulnerability assessments and analysis on NIH information systems and infrastructure.

• Execute threat-informed prioritization utilizing exploitability, threat intelligence, CISA Known Exploited Vulnerabilities (KEV), mission criticality, system exposure, and compensating controls.

• Evaluate vulnerability risk in relation to system criticality, data sensitivity, and organizational risk tolerance.

• Create vulnerability dashboards, remediation metrics, trend analyses, and executive reporting products.

• Review and analyze results from vulnerability scans generated by enterprise security tools.

• Validate findings to assess severity, exploitability, and potential impact.

• Perform risk-based prioritization of vulnerabilities and security weaknesses.

• Collaborate with technical teams to evaluate remediation requirements and timelines.

• Oversee the complete lifecycle of vulnerability identification, remediation, and closure.

• Track vulnerabilities from initial discovery through to remediation and validation.

• Maintain repositories for vulnerabilities, records of remediation, and status reports.

• Monitor remediation progress and escalate overdue findings when necessary.

• Confirm corrective actions and document closure activities.

• Support continuous monitoring of NIH systems and applications.

• Analyze trends in vulnerabilities and identify recurring issues.

• Assess security risks linked to identified vulnerabilities.

• Work in conjunction with RMF/A&A teams to facilitate Authorization to Operate (ATO) activities.

• Assist in the management and tracking of Plans of Action and Milestones (POA&Ms).

• Provide vulnerability-related evidence and documentation for audits, assessments, and authorization processes.

⛳️ Requirements

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related discipline.

• At least 5 years of experience in cybersecurity, vulnerability management, information assurance, or security operations within Federal environments.

• Experience in supporting the development of POA&Ms, tracking remediation, validating corrective actions, or closing vulnerabilities.

• Background in conducting vulnerability assessments and tracking remediation efforts.

• Familiarity with NIST Risk Management Framework (RMF) (SP 800-37).

• Knowledge of NIST SP 800-53 Rev. 5.

• Understanding of the Federal Information Security Management Act (FISMA).

• Acquaintance with Federal cybersecurity compliance requirements.

• Familiarity with risk assessment methodologies.

• Experience in analyzing vulnerability data and formulating remediation recommendations.

• Strong analytical, problem-solving, and communication abilities.

• Capability to obtain and maintain an NIH Public Trust.

• Preferred: Certifications such as Security+, CEH, CISSP, GVA, GISF, GSEC, CAP, CISM, or CRISC.

• Preferred: Experience working with NIH, HHS, or other Federal civilian agencies.

• Preferred: Experience in FISMA-compliant environments.

• Preferred: Knowledge of cloud security and vulnerability management practices.

• Preferred: Experience in supporting Continuous Diagnostics and Mitigation (CDM) initiatives.

• Preferred: Understanding of FedRAMP and Zero Trust security principles.

• Preferred: Experience coordinating remediation activities among multiple stakeholders.

🏝️ Benefits

• Comprehensive medical, dental, and vision coverage.

• Flexible Spending Account for healthcare and dependent care.

• Health Savings Account for high deductible medical plans.

• Retirement 401(k) plan with employer matching.

• Open leave policy and paid holidays.

• Tuition reimbursement program.

• Transportation expense account.

• Employee assistance program.