Vulnerability Management Manager

This is a fully remote position, open to applicants in United States.

📋 Description

• Lead a team of engineers focused on vulnerability management.

• Identify, monitor, prioritize, and drive the remediation of infrastructure and application vulnerabilities to resolution.

• Establish priorities, balance workloads, coordinate assignments, and offer technical guidance.

• Align remediation efforts with enterprise risk requirements, security policies, and BOD 26-04 obligations.

• Represent the infrastructure vulnerability management team during incident calls related to application vulnerabilities.

• Coordinate escalations and communicate the status of remediation efforts.

• Monitor emerging vulnerabilities, threat intelligence, adversary techniques, and industry trends.

• Apply knowledge of common attack vectors, intrusion techniques, and the MITRE ATT&CK framework for vulnerability prioritization.

• Utilize vulnerability assessment tools, SIEM platforms, network traffic analysis, and security event correlation to investigate findings and validate remediation.

• Develop and ensure the quality of monthly vulnerability and risk metrics for management and executive review.

• Identify gaps in processes and controls, implementing continuous improvements.

• Create and maintain processes, procedures, operational standards, and training documentation.

• Support the onboarding and development of vulnerability management engineers.

• Collaborate with application engineering, infrastructure operations, security operations, vendor management, and risk teams.

• Evaluate emerging security tools and assessment methodologies.

⛳️ Requirements

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field, or an equivalent combination of education and relevant experience.

• 6+ years of pertinent IT or cybersecurity experience.

• 5+ years of security experience with hands-on exposure to tools such as Qualys, Symantec, or Nessus.

• 3+ years of experience with SIEM platforms.

• 3+ years of experience in supporting or analyzing adversary tactics and techniques using the MITRE ATT&CK framework.

• Familiarity with ISO 27001, NIST CSF, NIST SP 800-53, PCI DSS ASV, and BOD 26-04.

• Strong skills in written and verbal communication, organization, analysis, and problem-solving.

• Ability to coordinate multiple initiatives and manage competing priorities while driving remediation across cross-functional teams.

• Availability to support after-hours and weekend on-call rotations as required.

• Preferred industry-recognized cybersecurity certification such as CompTIA Security+, CISSP, GIAC, or GCIH.

• Preferred experience with URL filtering, web proxy technologies, and troubleshooting.

• Preferred experience in creating executive presentations, developing risk metrics, and supporting management reporting.

• Candidates must currently be authorized to work in the United States without visa sponsorship now or in the future.

🏝️ Benefits

• Equal Opportunity employer.

• U.S. Federal Contractor.

• Support for employee growth and development.

• Participation in after-hours and weekend on-call rotations as required (job obligation, not a benefit).