IT Security Vulnerability Specialist (0036)

OCT Consulting, LLC•Suitland-Silver Hill, MD

22h•$110,000 - $130,000•Hybrid

About The Position

OCT Consulting is seeking an Associate to join its Cybersecurity practice as an IT Security Vulnerability Specialist supporting a federal client. This hybrid role requires at least three days per week onsite in Suitland, Maryland. The specialist will lead vulnerability remediation and management activities, communicate risks to technical and business stakeholders, conduct vulnerability assessments, maintain scanning and security tools, and support security operations and incident response. The role also includes configuration management responsibilities, such as maintaining plans and baselines, identifying configuration items, and monitoring compliance.

Requirements

At least 7 years of experience with A&A support.
Proficiency in all steps of the NIST Risk Management Framework (RMF).
Knowledge of NIST special publications, including 800-53 and 800-53A.
Bachelor's degree or equivalent experience.
In-depth understanding of and hands-on experience with multiple vulnerability scanning platforms, including scanning with Security Technical Implementation Guides (STIG) and CIS benchmarks.
Proficiency in MS Excel.
Must be a U.S. citizen.
Must hold a SECRET clearance.

Nice To Haves

A related industry certification, such as GIAC GEVA, CASP, CAP, CISSP, CISM, GSEC, GMON, or Security+.

Responsibilities

Lead and drive remediation efforts in a government environment to improve vulnerability management processes.
Explain vulnerability risk and impact to product, engineering, and business leaders, communicating the urgency of remediation according to enterprise risk.
Conduct internal vulnerability assessments and analyze external vulnerability reports, zero-day announcements, and security incidents.
Monitor and maintain vulnerability and code scanning, security configuration, and other vulnerability management tools.
Develop, maintain, and recommend vulnerability management security policies, procedures, and standards.
Participate in security audits and assessments to support compliance with regulatory requirements and industry standards.
Reproduce vulnerabilities and validate fixes when required.
Maintain knowledge of current security threats, remediations, and operational best practices in threat and vulnerability management.
Create reports and dashboards to support vulnerability remediation and process improvements.
Drive regular operational and business reviews for threat and vulnerability management activities.
Support other security operations activities, including detection and response, as needed.
Participate in security incident response.
Review, evaluate, refine, release, and maintain Configuration Management Plans in support of program requirements.
Recommend and provide guidance on identifying Configuration Items (CI) and Computer Software Configuration Items (CSCI).
Provide expertise and guidance for establishing, monitoring, and maintaining configuration baselines on assigned programs.
Monitor effectiveness and compliance on assigned programs.