Security and Vulnerability Management Engineer

Peraton•Washington, DC

3d•$112,000 - $179,000•Hybrid

About The Position

Peraton is hiring a Security and Vulnerability Management Engineer for a full-time assignment expected to last approximately nine months, from November 2026 through July 2027. The position is based in Washington, DC, with on-site work Monday through Wednesday and up to two remote days per week. The engineer will conduct vulnerability assessments and coordinate remediation across enterprise systems, endpoints, networks, Microsoft SQL Server, VDI, and AWS and Azure workloads. The role also covers patch management, endpoint security, firewall and network configuration reviews, cloud security posture, identity and access management, and support for penetration testing and red-team exercises. The engineer will establish risk-based vulnerability prioritization and remediation governance, optimize Nessus scanning, reduce the vulnerability backlog, coordinate and retest remediation, and develop metrics and dashboards for technical and executive audiences. The role includes formal change management, continuity documentation related to patching and critical systems, and production of detailed security assessments, runbooks, playbooks, SOPs, secure configuration references, and other technical documentation. Technical writing is a functional requirement. The position requires periodic local travel to an alternate computing facility in the DC metro area; that local travel is not separately reimbursed. After-hours work may be needed for patching windows, assessments, policy changes, incident response, and critical vulnerability response. Candidates must be U.S. citizens and able to obtain and maintain a Tier 2 Public Trust, including the required checks and in-person fingerprinting. The anticipated start is on or about November 1, 2026.

Requirements

A bachelor's degree and 8 years of relevant experience, a master's degree and 6 years of relevant experience, or 12 years of experience in lieu of a degree.
At least 5 years of hands-on experience, regardless of degree path.
At least 5 years of hands-on experience delivering enterprise-scale cybersecurity projects spanning vulnerability assessment, remediation planning, endpoint security, system hardening, and penetration testing.
Demonstrated experience performing authenticated and unauthenticated vulnerability assessments and producing validated, evidence-based findings.
Strong working knowledge of NIST SP 800-53 Rev. 5, NIST RMF, defense-in-depth, Zero Trust, and IRS Publication 1075.
Hands-on remediation and patching experience across Windows Server, Linux, and Microsoft SQL Server; AWS and Azure administration sufficient to perform cloud posture reviews.
Check Point firewall and endpoint policy administration experience.
Microsoft Defender policy administration for Windows and macOS.
Proficiency with Nessus, Burp Suite, Nmap, and Kali Linux or equivalent tools.
Network analysis experience covering segmentation, firewall rules, DNS dependencies, routing logic, and cloud network configurations.
IAM security experience, including Conditional Access, PIM, and MFA enforcement.
SIEM correlation experience using Microsoft Sentinel, Varonis, or equivalent.
Scripting experience in Python, PowerShell, or C#.
Patch tooling experience with Microsoft Configuration Manager, Ivanti, or Jamf.
Enterprise virtualization and VDI experience.
Formal change management experience building, submitting, and tracking change requests, including validation and rollback planning.
Ability to independently plan, execute, document, and validate technical deliverables to acceptance, with reproducible steps and retest results, without significant rework cycles.
Ability to obtain and maintain a Tier 2 Public Trust, including a credit check, FBI criminal history check, and in-person fingerprinting at a designated federal facility in Washington, DC; typical processing is 60 to 120 days.
Willingness to complete IRS Publication 1075 Federal Tax Information training before system access if assigned to FTI-connected systems.
Ability to work on site in Washington, DC Monday through Wednesday and support after-hours activity.
Immediate availability; anticipated start on or about November 1, 2026.
U.S. citizenship is required.
Must be able to obtain and maintain a Tier 2 Public Trust clearance.

Nice To Haves

Bachelor's degree in IT, Computer Science, Cybersecurity, or a related field.
CISSP, CISM, GIAC, OSCP, CEH, Security+, AWS Certified Security – Specialty, or Microsoft security certifications such as AZ-500 Security Engineer Associate; certifications are preferred but not mandatory.
SOC operations, incident response, or red-team experience.
Social engineering and physical security testing experience.
Experience with vulnerability management metrics, dashboards, and executive risk reporting.
Automation scripting, playbook development, and workflow integration experience.
Zero Trust network architecture, NAC/ISE review, and IPS/IDS tuning experience.
Remediation runbooks, secure configuration baselines, and hardening standards experience.
Prior federal agency or IRS Publication 1075 environment experience.
Located in the Washington, DC metropolitan area.

Responsibilities

Conduct authenticated and unauthenticated vulnerability assessments across servers, endpoints, network devices, Microsoft SQL Server instances, VDI, and AWS and Azure cloud workloads, documenting validated findings with reproducible steps and supporting evidence.
Build and maintain a risk-based prioritization matrix using CVSS severity, asset criticality, and real-world exploitability, with supporting asset inventory and scan coverage records.
Optimize the Nessus scanning program by tuning policies, resolving credentialed-scan failures, refining schedules, and closing coverage gaps across on-premises, cloud, and VDI environments.
Correlate findings against Microsoft Sentinel and Varonis, with Splunk secondarily, to validate results and systematically suppress false positives.
Establish and operate remediation governance, including ownership and accountability, risk-based prioritization, SLA targets, closure standards, and escalation workflows; deliver an initial Governance and Process Improvement Plan within 60 days of starting.
Drive vulnerability backlog reduction by analyzing deferred findings, developing targeted remediation plans, and tracking burn-down to closure.
Coordinate remediation with system owners, validate and retest fixes, and document outcomes.
Perform root cause analysis of recurring vulnerability patterns and implement corrective and preventive process and tooling improvements with named owners and target dates.
Build dashboards and metrics for technical and executive audiences, including MTTR, aging, backlog burn-down, patch compliance percentage, and exception tracking.
Design and improve endpoint patch deployment rings, maintenance windows, and automation using Microsoft Configuration Manager, Ivanti, and Jamf; produce compliance metrics.
Develop risk-based Windows and Linux server patching plans and workflows, submit and track formal change requests, validate results, and document rollback procedures.
Support critical service continuity by updating business continuity and disaster recovery documentation related to patching and critical systems.
Review Check Point configurations for misconfigurations, overly permissive rules, and deprecated policy objects; implement hardened configurations through approved change management and produce validation documentation.
Review and tune Microsoft Defender policies for Windows and macOS against NIST SP 800-53 Rev. 5, including Jamf-managed macOS compliance, using pilot testing before enterprise rollout.
Analyze network layers, including firewall rule sets, ACLs, NAT, DNS dependency chains, routing logic, and segmentation; review VPN, proxy filtering, and IPS/IDS configurations; troubleshoot identity and access paths.
Conduct AWS and Azure cloud and network security posture reviews, including network segmentation and ZTNA gateway review.
Review Entra ID and Active Directory Domain Services architecture; enhance Conditional Access policies; and assess PIM and MFA enforcement coverage and gaps.
Support penetration testing and red-team exercises, and produce formal Security Assessment Reports covering scope, findings, evidence, impact, recommendations, proof-of-concept reproduction steps, and retest results.
Author runbooks, playbooks, SOPs, secure configuration references, change implementation documentation, and knowledge transfer documentation.
Deliver weekly status reports covering tasks, blockers, risks, and after-hours work; monthly vulnerability management, endpoint patch compliance, and server patching and change request reports; security assessment reports after each assessment; and critical vulnerability notifications within the timeframe specified by the Customer.
Perform after-hours work as needed for patching windows, assessments, policy changes, incident response, and critical vulnerability response.
Travel periodically to the Customer's alternate computing facility in the DC metro area as directed.