IT Security Vulnerability Specialist (0036)

OCT Consulting•Suitland-Silver Hill, MD

9d•Onsite

About The Position

OCT Consulting is seeking an IT Security Vulnerability Specialist to support a federal client in Suitland, Maryland, as part of its Cybersecurity practice. The role focuses on vulnerability management and related security operations, including assessment, remediation, policy development, compliance, incident response, and configuration management. The position requires full-time onsite work during the initial training and performance evaluation period, which may last approximately two to three months or longer, depending on performance and the hiring manager’s assessment. The ideal candidate is proficient in vulnerability management, intrusion prevention and detection, access control and authorization, policy enforcement, application security, protocol analysis, firewall management, incident response, data loss prevention, encryption, two-factor authentication, web filtering, and advanced threat protection. The role also supports configuration management plans, configuration items, and configuration baselines for assigned programs.

Requirements

At least 7 years of experience with A&A support.
Proficiency in all steps of the NIST Risk Management Framework (RMF).
Knowledge of NIST special publications, including 800-53 and 800-53A.
Bachelor’s degree or equivalent experience.
In-depth understanding and hands-on experience with multiple vulnerability scanning platforms, including scanning against Security Technical Implementation Guides (STIGs) and CIS benchmarks.
Proficiency with MS Excel.
A related industry certification, such as GIAC GEVA, CASP, CAP, CISSP, CISM, GSEC, GMON, or Security+.
Must be a U.S. citizen.
Active SECRET clearance required.

Responsibilities

Lead and drive remediation efforts in a government environment to improve the efficiency of vulnerability management processes.
Communicate vulnerability risk, impact, urgency, and remediation needs to product, engineering, and business leaders.
Conduct internal vulnerability assessments and analyze external vulnerability reports, zero-day announcements, and security incidents.
Monitor and maintain vulnerability and code scanning, security configuration, and other vulnerability management tools.
Develop, maintain, and recommend security policies, procedures, and standards related to vulnerability management.
Participate in security audits and assessments to support compliance with regulatory requirements and industry standards.
Reproduce vulnerabilities and validate fixes where required.
Maintain knowledge of security threats, remediations, and operational best practices in threat and vulnerability management.
Create reports and dashboards to support vulnerability remediation and process improvements.
Lead regular operational and business reviews for threat and vulnerability management activities.
Support other security operations activities as needed, including detection and response.
Participate in security incident response.
Review, evaluate, refine, release, and maintain Configuration Management Plans in support of program requirements.
Recommend and provide guidance on identifying Configuration Items and Computer Software Configuration Items.
Provide guidance and expertise for establishing, monitoring, and maintaining configuration baselines on assigned programs.
Monitor effectiveness and compliance on assigned programs.