Security and Vulnerability Management Engineer

Peraton•Washington, DC

1d•Hybrid

About The Position

Peraton is hiring a Security and Vulnerability Management Engineer for an approximately nine-month, full-time assignment from November 2026 through July 2027. The role is based in Washington, DC, with on-site work Monday through Wednesday and up to two remote days per week. Periodic local travel to an alternate computing facility in the DC metro area is required and is not separately reimbursed. The successful candidate must be able to obtain and maintain a Tier 2 Public Trust, be a U.S. citizen, and be available to start on or about November 1, 2026. The engineer will conduct enterprise vulnerability assessments and oversee remediation, patching, endpoint security, system hardening, firewall and network reviews, cloud security posture, and identity security. The role includes optimizing Nessus scanning, correlating findings with SIEM and related tools, and establishing vulnerability remediation governance. The engineer will coordinate with system owners, validate fixes, reduce the vulnerability backlog, and develop metrics and dashboards for technical and executive audiences. The position also supports penetration testing and red team exercises, formal security assessments, patch management and change control, critical service continuity documentation, and security policy improvements. Strong technical writing is a functional requirement. Deliverables include runbooks, SOPs, secure configuration references, change documentation, knowledge transfer materials, weekly status reports, monthly vulnerability and patching reports, assessment reports, and timely critical vulnerability notifications. After-hours work may be needed for patching windows, assessments, policy changes, incident response, and critical vulnerability response.

Requirements

Bachelor’s degree and 8 years of relevant experience, master’s degree and 6 years, or 12 years of experience in lieu of a degree; at least 5 years of hands-on experience is required regardless of degree path.
At least 5 years of hands-on experience delivering enterprise-scale cybersecurity projects spanning vulnerability assessment, remediation planning, endpoint security, system hardening, and penetration testing.
Experience conducting authenticated and unauthenticated vulnerability assessments and producing validated, evidence-based findings.
Working knowledge of NIST SP 800-53 Rev. 5, NIST RMF, defense-in-depth, Zero Trust, and IRS Publication 1075.
Hands-on remediation and patching experience across Windows Server, Linux, and Microsoft SQL Server.
AWS and Azure administration experience sufficient to perform cloud posture reviews.
Check Point firewall and endpoint policy administration experience.
Microsoft Defender policy administration for Windows and macOS.
Proficiency with Nessus, Burp Suite, Nmap, and Kali Linux or equivalent tools.
Network analysis experience involving segmentation, firewall rules, DNS dependencies, routing, and cloud network configurations.
IAM security experience, including Conditional Access, PIM, and MFA enforcement.
SIEM correlation experience using Microsoft Sentinel, Varonis, or equivalent.
Scripting experience in Python, PowerShell, or C#.
Patch tooling experience with Microsoft Configuration Manager, Ivanti, or Jamf.
Enterprise virtualization and VDI experience.
Formal change management experience, including creating, submitting, and tracking change requests with validation and rollback planning.
Ability to independently plan, execute, document, and validate technical deliverables to acceptance with reproducible steps and retest results, without significant rework cycles.
Ability to obtain and maintain a Tier 2 Public Trust, including a credit check, FBI criminal history check, and in-person fingerprinting at a designated federal facility in Washington, DC; typical processing is 60 to 120 days.
Willingness to complete IRS Publication 1075 Federal Tax Information training before system access if assigned to FTI-connected systems.
Ability to work on site in Washington, DC Monday through Wednesday and support after-hours activity.
Immediate availability, with anticipated start on or about November 1, 2026.
U.S. citizenship required.

Nice To Haves

Bachelor’s degree in IT, Computer Science, Cybersecurity, or a related field.
CISSP, CISM, GIAC, OSCP, CEH, Security+, AWS Certified Security – Specialty, or Microsoft security certifications such as AZ-500 Security Engineer Associate; certifications are preferred but not mandatory.
SOC operations, incident response, or red team experience.
Social engineering and physical security testing experience.
Experience developing vulnerability management metrics, dashboards, and executive risk reporting.
Automation scripting, playbook development, and workflow integration experience.
Zero Trust network architecture, NAC/ISE review, and IPS/IDS tuning experience.
Experience developing remediation runbooks, secure configuration baselines, and hardening standards.
Prior federal agency or IRS Publication 1075 environment experience.
Located in the Washington, DC metropolitan area.

Responsibilities

Conduct authenticated and unauthenticated vulnerability assessments of servers, endpoints, network devices, Microsoft SQL Server, VDI, and AWS and Azure workloads, documenting validated findings, reproducible steps, and supporting evidence.
Build and maintain a risk-based prioritization matrix using CVSS severity, asset criticality, and real-world exploitability, along with asset inventory and scan coverage records.
Optimize Nessus scanning by tuning policies, resolving credentialed-scan failures, refining schedules, and closing coverage gaps across on-premises, cloud, and VDI environments.
Correlate vulnerability findings against Microsoft Sentinel and Varonis, and secondarily Splunk, to validate results and suppress false positives.
Establish and operate remediation governance, including ownership and accountability, risk prioritization, SLA targets, closure standards, and escalation workflows; deliver an initial Governance and Process Improvement Plan within 60 days of starting.
Reduce the vulnerability backlog by analyzing causes of deferred findings, planning targeted remediation, and tracking progress through closure.
Coordinate remediation with system owners, validate and retest fixes, and document retest outcomes.
Analyze recurring vulnerability patterns and implement corrective and preventive process and tooling improvements with named owners and target dates.
Develop technical and executive dashboards and metrics covering MTTR, finding age, backlog burn-down, patch compliance, and exceptions.
Improve endpoint patch deployment rings, maintenance windows, and automation using Microsoft Configuration Manager, Ivanti, and Jamf, and produce compliance metrics.
Develop risk-based Windows and Linux server patching plans and workflows; submit and track formal change requests, validate outcomes, and document rollback procedures.
Support continuity of critical services by updating business continuity and disaster recovery documentation related to patching and critical systems.
Review Check Point configurations for misconfigurations, overly permissive rules, and deprecated policy objects; implement hardened configurations through approved change management and document validation.
Review and tune Microsoft Defender policies for Windows and macOS against NIST SP 800-53 Rev. 5, including Jamf-managed macOS compliance, and pilot changes before enterprise rollout.
Analyze network layers, including firewall rule sets, ACLs, NAT, DNS dependencies, routing, and segmentation; review VPN, proxy filtering, and IPS/IDS configurations; troubleshoot identity and access paths.
Review AWS and Azure cloud and network security posture, including network segmentation and ZTNA gateways.
Review Entra ID and Active Directory Domain Services architecture; improve Conditional Access policies and assess PIM and MFA enforcement coverage and gaps.
Support penetration testing and red team exercises, and prepare formal Security Assessment Reports with scope, findings, evidence, impact, recommendations, proof-of-concept reproduction steps, and retest results.
Write runbooks, playbooks, SOPs, secure configuration references, change implementation documentation, and knowledge transfer documentation.
Provide weekly status reports on tasks, blockers, risks, and after-hours work; monthly vulnerability management, endpoint patch compliance, and server patching and change request reports; assessment reports after each assessment; and critical vulnerability notifications within the Customer’s specified timeframe.
Perform after-hours work as needed for patching windows, assessments, policy changes, incident response, and critical vulnerability response.
Travel periodically to the Customer’s alternate computing facility in the DC metro area as directed.