Vulnerability Management Analyst

Vulnerability Management AnalystLocation: Remote (Must live in a commutable distance to Crownsville, MD)Job Description:Duties and Responsibilities:Daily oversight of vulnerability management programServe as liaison between Security Assessment and Security Operation Center (SOC) functions on matters pertaining to vulnerability scanning for security assessment effortsPlan, execute, monitor and control, and successfully close vulnerability management projects/tasksConfigure and schedule patch and secure configurations audit scan jobs (vulnerability scans)Maintain configurations of patch and secure configurations scan jobs i.e., asset lists, scan plugins, STIGs audit files, CIS Benchmarks audit files, scan credentialsTroubleshoot and resolve failed patch and secure configurations scan jobs i.e., missing credentials, asset list updates, firewall issuesAnalyze patch and secure configurations audit scan results and identify and document technical and procedural vulnerability findingsResearch resolution strategies/measures for identified vulnerability findings and provide remediation/mitigation recommendationsIdentify false positive findings and determine and advise on the criteria for validating the findings i.e., required artifactsPrepare vulnerability management reports on the status of patch and secure configuration audit scans and associated remediation effortsCommunicate status vulnerability management efforts to include regular scheduled reports and as well as ad hoc reportsEnsure the vulnerability management platform maintains updated versions of secure configurations scans audit files i.e., proprietary vendor audit files, STIGs audit files, CIS Benchmarks audit filesEnsure that vulnerability management services are operating as expected i.e., completeness of the of each scope scan jobs, timely completion of scan jobs, up-to-date patch audit pluginsEnsure proper functioning of integrations between the vulnerability management platform and other tools such as asset management and risk management platformsEnsure and data updates from vulnerability management platforms to asset management and risk management platform are running as scheduledMaintain knowledge of applicable cyber defense policies, regulations, and compliance documents specifically related to cyber defense auditing.Development and implementation operational and technical vulnerability management policiesDefining, developing, implementing, and processes and procedures for to support and maintain vulnerability management programAt least five (12) years of experience with NIST Risk Management Framework (RMF) supporting technical assessment (vulnerability scans) of control implementations and continuous monitoring post-system Authority to Operate (ATO)At least ten (10) years of hands-on experience in LAN Administration i.e., Hands-on administration of Windows OS and Linux OS, and hands-on basics administration of routers, switches, and firewalls.At least five (5) years of hands-on experience with Tenable Security Center/ Nessus Scanners i.e., creating, maintaining, and running scan jobs and analyzing scan resultsAt least five (5) years of hands-on experience planning, executing, monitoring and controlling, and closing security assessment projectsAssociates or bachelor’s degree from an accredited college or university with a major in Computer Science, Information Systems, Engineering or related scientific or technical discipline.Ability to work outside of regular business hours, the role may require on-call support after regular business hours or weekends.Required Skills/Certifications:At least 1 security management industry certifications such as CISSP, CISM, CISA, CRISC etc.Self-starter, able to gather requirements, plan, execute system deployment efforts.Able to perform conduct vulnerability assessment of technical security controls, identify and validate findings, research resolutions, and provide remediation/mitigation recommendations.Experience with the vulnerability management tools such as Tenable One, Security Center/Nessus Scanners, Tenable.io, Web Inspect, DB Protect etc.LAN administration experience, particularly with Windows OS and Linux OS.Experience with the vulnerability management tools such as Tenable Security Center/Nessus Scanners, Web Inspect, DB Protect etc.Experience with Governance, Risk, and Compliance (GRC) platforms such as RSA Archer, ServiceNow GRC, CSAMCustomer-oriented with excellent issue follow-through and resolution abilities.Excellent written and oral communication, and presentation skills.Ability to effectively work both autonomously as well as on a team.Outstanding interpersonal skills, strong work ethic, and self-motivated.Utilize tools and analytical skills to plan and execute technical changes.Relevant industry certification.Desired Skills/Certifications: Experience with the vulnerability management tools such as Tenable One, Security Center/Nessus Scanners, Tenable.io, Web Inspect, DB Protect etc.Experience with ServiceNow Vulnerability Response and Governance, Risk, and Compliance (GRC) modules.Experience with Window, Linux, Database, and Web Apps system administration.Experience in project task technical analysis, planning, and estimation.Experience with technology capabilities market research, technical analysis/review, and recommendation.Other relevant industry certifications such as Security +, CAP, CEH etc.