M3
Vulnerability Management Engineer/Lead
Merit 321
Location not stated
Staff / Principal
2 months ago
- Vulnerability Management
- CISA
- FISMA
- Tenable
- Qualys
- Microsoft Defender
- CVSS
- NIST
- CISSP
- CISM
- Defender
- CySA+
- CompTIA Security+
2 months ago
Vulnerability Management Position Descriptions
Senior Vulnerability Management Engineer / Lead
Position Summary
The Senior Vulnerability Management Engineer leads enterprise vulnerability management activities across NIH/OD-managed environments, providing technical leadership for vulnerability identification, risk prioritization, remediation coordination, reporting, and compliance.Key Responsibilities
- Lead enterprise vulnerability management operations and continuous program improvement.
- Manage and optimize vulnerability scanning infrastructure and tools.
- Oversee credentialed host, network, application, database, and endpoint vulnerability scanning.
- Analyze scan results and prioritize vulnerabilities based on risk and federal requirements.
- Lead vulnerability discovery, validation, mitigation, remediation tracking, and closure.
- Ensure critical vulnerabilities are escalated and tracked through resolution.
- Monitor the CISA Known Exploited Vulnerabilities (KEV) Catalog and other authoritative sources.
- Coordinate remediation activities with system owners and technical teams.
- Provide risk analysis and technical recommendations for identified vulnerabilities.
- Support specialized vulnerability assessments for High Value Assets.
- Develop reports, dashboards, metrics, and executive briefings.
- Ensure reporting complies with NIH, HHS, CISA, FISMA, and HVA requirements.
- Improve tool tuning, asset visibility, and reporting accuracy.
- Mentor mid-level and junior staff.
Minimum Qualifications
- Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, or related field.
- 8–12 years of cybersecurity experience, including at least 5 years in enterprise vulnerability management.
- Experience with Tenable, Qualys, Rapid7, Microsoft Defender Vulnerability Management, or similar tools.
- Knowledge of CVEs, CVSS, KEVs, NIST guidance, FISMA, CISA directives, and federal vulnerability remediation requirements.
- Strong communication and reporting skills.
Recommended Certifications
- CISSP
- CISM
- GIAC Certified Enterprise Defender (GCED)
- GIAC Certified Vulnerability Assessor (GCVA)
- CompTIA CySA+
- Tenable Certified Professional
- Qualys VMDR Certification
Mid-Level Vulnerability Management Analyst
Position Summary
The Mid-Level Vulnerability Management Analyst performs vulnerability scanning, analysis, reporting, remediation tracking, and stakeholder coordination across NIH/OD-managed systems.Key Responsibilities
- Perform scheduled and ad hoc credentialed vulnerability scans.
- Review and analyze vulnerability scan results.
- Identify critical and known exploited vulnerabilities.
- Monitor the CISA KEV Catalog and other approved sources.
- Notify technical contacts of vulnerabilities and configuration issues.
- Develop remediation recommendations.
- Track vulnerabilities through closure and validate remediation.
- Support High Value Asset assessments.
- Prepare recurring and ad hoc vulnerability reports.
- Maintain documentation and support process improvements.
Minimum Qualifications
- Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field.
- 3–6 years of cybersecurity experience with vulnerability management.
- Experience with enterprise vulnerability management platforms.
- Knowledge of CVEs, CVSS, KEVs, NIST guidance, and FISMA.
- Strong analytical and communication skills.
Recommended Certifications
- CompTIA Security+
- CompTIA CySA+
- GIAC Certified Vulnerability Assessor (GCVA)
- ISC2 Certified in Cybersecurity (CC)
- Tenable Certified Professional
- Qualys VMDR Certification
Suggested Experience Levels
| Labor Category | Experience | Primary Focus |
| Senior Vulnerability Management Engineer / Lead | 8–12+ years | Program leadership, risk prioritization, remediation governance, reporting, compliance, stakeholder coordination |
| Mid-Level Vulnerability Management Analyst | 3–6 years | Scanning, analysis, remediation guidance, validation, KEV monitoring, reporting |
Vulnerability Management Engineer/Lead · Merit 321