Security & Vulnerability Management Engineer

Peraton•Washington, DC

16h•Hybrid

About The Position

Peraton is hiring an experienced, hands-on Security & Vulnerability Management Engineer for its Federal Strategic Cyber programs. The position executes cybersecurity engineering and implementation initiatives in a hybrid Microsoft, AWS, and Azure federal enterprise environment. It is a project-driven engineering role rather than a traditional assessment, advisory, compliance, or steady-state security operations position. The engineer is the single dedicated technical engineering resource responsible for ten security improvement projects across vulnerability management, endpoint protection, patch management, firewall and network security, identity and access management, and security governance. The engineer owns technical deliverables from assessment and solution design through implementation, testing, validation, documentation, and completion. Responsibilities include configuring and hardening enterprise security technologies, implementing approved remediation and security configuration changes, optimizing security platforms, and documenting measurable improvements. The customer retains responsibility for risk acceptance and policy approvals; the engineer executes approved technical improvements. The environment operates under federal cybersecurity requirements, including IRS Publication 1075, NIST SP 800-53 Revision 5, and the NIST Risk Management Framework. The position is based in Washington, DC, with a hybrid arrangement requiring on-site work Monday through Wednesday and allowing up to two remote days per week. A Tier 2 Public Trust background investigation is required, and applicants must be U.S. citizens. The target salary range is $135,000–$216,000; employees may also be eligible for overtime, shift differential, and a discretionary bonus depending on the position.

Requirements

Bachelor's degree and 12 years of relevant experience; an additional four years of experience may be considered in lieu of the bachelor's degree.
At least five years of hands-on enterprise cybersecurity experience, including vulnerability assessment, endpoint security, system hardening, and penetration testing.
Demonstrated personal experience configuring, implementing, hardening, troubleshooting, and validating enterprise security technologies and controls.
Ability to independently execute technical security improvement initiatives from assessment and design through implementation, validation, and documentation.
Experience making security configuration changes and performing remediation in production enterprise environments.
Hands-on enterprise firewall configuration and implementation experience with Check Point, Palo Alto Networks, or Cisco; ability to apply firewall engineering expertise to the customer's Check Point environment.
Experience personally configuring, modifying, implementing, troubleshooting, and validating firewall security policies, rules, access controls, and hardening measures in production, using formal change-management procedures.
Hands-on Microsoft Defender endpoint protection configuration, policy implementation, and security tuning for Windows and macOS.
Hands-on Tenable Nessus scan configuration, credentialed scanning, troubleshooting, and optimization.
Experience with MECM, Ivanti, and Jamf for endpoint management, patch deployment, configuration management, and automation.
Experience configuring Microsoft Entra ID and Active Directory controls, including Conditional Access, PIM, MFA, and identity security controls.
Experience identifying, prioritizing, and directly remediating enterprise vulnerabilities; developing remediation governance frameworks, patching workflows, ownership models, and escalation procedures.
Experience implementing and validating security hardening and remediation changes.
Knowledge of formal change-management processes, including testing, implementation, rollback planning, and documentation.
Experience developing technical runbooks, SOPs, and secure configuration documentation.
Working knowledge of NIST SP 800-53 Revision 5, the NIST Risk Management Framework, Zero Trust principles, and IRS Publication 1075.
Experience with at least one of Microsoft Sentinel, Varonis, or Splunk.
Hands-on scripting experience with one or more of Python, PowerShell, or C#.
Experience analyzing and implementing security configurations involving firewall rules, network segmentation, DNS, routing, and cloud networking.
Experience supporting security engineering in hybrid on-premises and AWS/Azure environments, including troubleshooting and remediating network and cloud security configuration weaknesses.
Experience configuring Conditional Access policies; familiarity with PIM and privileged access controls; experience assessing and improving MFA enforcement and identity security configurations.
Must be a U.S. citizen and meet requirements for a Tier 2 Public Trust background investigation.
Must be able to work on-site in Washington, DC, Monday through Wednesday, with up to two remote workdays per week.
Ability to work independently, manage multiple technical deliverables, and communicate effectively with technical and customer stakeholders.
Strong technical writing and documentation skills.

Nice To Haves

Bachelor's degree in Information Technology, Computer Science, Cybersecurity, or a closely related technical discipline.
One or more of the following certifications: CISSP, OSCP, GIAC, CEH, CompTIA Security+, Microsoft Certified: Azure Security Engineer Associate (AZ-500), AWS Certified Security – Specialty, or CISM.
Previous cybersecurity engineering experience supporting federal agencies or environments governed by IRS Publication 1075.
Experience supporting SOC operations, incident response, penetration testing, or red team exercises.
Residency within the Washington, DC metropolitan area.
Direct experience configuring and implementing security controls within Check Point firewall environments.

Responsibilities

Conduct authenticated and unauthenticated vulnerability assessments across enterprise servers, endpoints, network devices, SQL Server, VDI, and AWS/Azure workloads.
Implement and validate technical remediation, secure configuration changes, system hardening, and vulnerability resolution.
Develop a risk-based vulnerability prioritization matrix using CVSS ratings, asset criticality, and exploitability.
Establish vulnerability remediation governance, including ownership models, SLA targets, closure standards, and escalation workflows; deliver a Vulnerability Remediation Governance Plan within the first 60 days.
Reduce vulnerability backlogs through root cause analysis, targeted remediation plans, direct technical remediation, and measurable burn-down tracking.
Configure, tune, and optimize Tenable Nessus scanning policies and infrastructure; troubleshoot credentialed-scan failures and address coverage gaps across on-premises, cloud, and VDI environments.
Correlate vulnerability findings with Microsoft Sentinel, Varonis, and Splunk to validate results, identify discrepancies, and suppress false positives; improve scan accuracy, effectiveness, and reporting.
Develop and maintain dashboards and metrics for technical and executive audiences, including MTTR, vulnerability aging, patch compliance, and security exception tracking.
Configure, implement, and optimize patch-management solutions using MECM, Ivanti, and Jamf; design patch deployment rings, maintenance windows, and automated patching workflows.
Develop and execute risk-based Windows and Linux server patching plans, and implement endpoint and server security hardening measures.
Prepare, submit, and track formal change requests, including implementation, testing, validation, and rollback documentation; update business continuity and disaster recovery documentation related to patch management.
Configure, implement, and harden firewall policies through approved change control, addressing misconfigurations, overly permissive rules, deprecated objects, and unnecessary access permissions.
Assess, configure, implement, troubleshoot, and validate improvements in the customer's Check Point firewall environment, applying enterprise firewall engineering experience with Check Point, Palo Alto Networks, or Cisco technologies.
Configure, implement, and tune Microsoft Defender policies for Windows and macOS endpoints in alignment with NIST SP 800-53 Revision 5.
Assess, troubleshoot, and implement network security improvements involving firewall rules and ACLs, NAT, DNS, segmentation and routing, VPNs, proxy services, and IPS/IDS.
Conduct AWS and Azure cloud security posture reviews and implement approved configuration improvements.
Assess ZTNA gateway configurations and recommend and implement appropriate security enhancements.
Configure and enhance Microsoft Entra ID and Active Directory security controls, including Conditional Access; assess and improve PIM configurations and MFA enforcement; remediate IAM security gaps through approved changes.
Support penetration testing and red team exercises, including findings validation and technical remediation.
Prepare Security Assessment Reports documenting identified risks, remediation measures, and remaining security considerations.
Develop and maintain security engineering runbooks and playbooks, SOPs, secure configuration baselines and references, implementation and validation procedures, and knowledge-transfer and operational-transition documentation.
Prepare weekly project status reports and monthly patch compliance and vulnerability management reports; provide critical vulnerability notifications according to customer-defined SLAs.
Document implemented security configuration changes, remediation outcomes, and technical deliverables to support operational continuity and audit readiness.

Benefits

Medical insurance
Dental insurance
Vision insurance
Life insurance
Health savings account
Short- and long-term disability
Employee assistance program (EAP)
Parental leave
401(k)
Paid time off for vacation
Company-paid holidays
Potential eligibility for overtime, shift differential, and a discretionary bonus, depending on the position