Security & Vulnerability Management Engineer

Peraton•Washington, DC

21h•$135,000 - $216,000•Hybrid

About The Position

Peraton is hiring an experienced, hands-on Security & Vulnerability Management Engineer to execute cybersecurity improvement initiatives in a hybrid Microsoft, AWS, and Azure federal enterprise environment. This is a project-driven cybersecurity engineering and implementation role—not a traditional security assessment, advisory, compliance, or steady-state security operations position. The engineer will serve as the dedicated technical engineering resource for ten security improvement projects across vulnerability management, endpoint protection, patch management, firewall and network security, identity and access management, and security governance. The role owns technical deliverables from assessment and solution design through implementation, testing, validation, documentation, and completion. The engineer will personally configure, implement, harden, troubleshoot, and validate enterprise security technologies and controls, and will execute approved technical changes and remediation. The customer retains responsibility for risk acceptance and policy approvals. The environment follows federal cybersecurity requirements, including IRS Publication 1075, NIST SP 800-53 Revision 5, and the NIST Risk Management Framework. The position is based in Washington, DC, with an on-site schedule Monday through Wednesday and up to two remote workdays per week. A Tier 2 Public Trust background investigation is required, and candidates must be U.S. citizens.

Requirements

Bachelor's degree and 12 years of relevant experience, or an additional 4 years of experience in lieu of a bachelor's degree.
At least 5 years of hands-on enterprise cybersecurity experience, including vulnerability assessment, endpoint security, system hardening, and penetration testing.
Demonstrated experience directly configuring, implementing, hardening, troubleshooting, and validating enterprise security technologies and controls.
Ability to independently execute technical security improvement initiatives from assessment and design through implementation, validation, and documentation.
Experience making security configuration changes and performing remediation in production enterprise environments.
Hands-on enterprise firewall configuration and implementation experience with Check Point, Palo Alto Networks, or Cisco; ability to apply firewall engineering experience to the customer's Check Point environment.
Experience configuring, modifying, troubleshooting, and validating firewall policies, rules, access controls, and hardening measures in production under formal change-management procedures.
Hands-on Microsoft Defender endpoint protection configuration, policy implementation, and security tuning for Windows and macOS.
Hands-on Tenable Nessus scan configuration, credentialed scanning, troubleshooting, and optimization.
Experience with MECM, Ivanti, and Jamf for endpoint management, patch deployment, configuration management, and automation.
Microsoft Entra ID and Active Directory experience with Conditional Access, PIM, MFA, and identity security controls.
Experience identifying, prioritizing, and directly remediating enterprise security vulnerabilities.
Ability to develop remediation governance frameworks, patching workflows, ownership models, and escalation procedures.
Experience implementing and validating secure configurations and remediation changes.
Knowledge of formal change-management processes, including testing, implementation, rollback planning, and documentation.
Experience developing technical runbooks, SOPs, and secure configuration documentation.
Working knowledge of NIST SP 800-53 Revision 5, the NIST RMF, Zero Trust principles, and IRS Publication 1075.
Experience with at least one of Microsoft Sentinel, Varonis, or Splunk.
Hands-on scripting experience with one or more of Python, PowerShell, or C#.
Experience analyzing and implementing security configurations involving firewall rules, network segmentation, DNS, routing, and cloud networking.
Experience supporting security engineering in hybrid on-premises and AWS/Azure environments, including troubleshooting and remediating network and cloud security weaknesses.
Experience configuring and implementing Conditional Access policies; familiarity with PIM and privileged access controls; experience assessing and improving MFA enforcement and identity security.
Must be a U.S. citizen and meet Tier 2 Public Trust background investigation requirements.
Must be able to work on-site in Washington, DC, Monday through Wednesday, with up to two remote workdays per week.
Must be able to work independently, manage multiple technical deliverables, and communicate effectively with technical and customer stakeholders.
Strong technical writing and documentation skills.

Nice To Haves

Bachelor's degree in Information Technology, Computer Science, Cybersecurity, or a closely related technical discipline.
One or more of the following certifications: CISSP, OSCP, GIAC, CEH, CompTIA Security+, Microsoft Certified: Azure Security Engineer Associate (AZ-500), AWS Certified Security – Specialty, or CISM.
Previous cybersecurity engineering experience supporting federal agencies or environments governed by IRS Publication 1075.
Experience supporting SOC operations, incident response, penetration testing, or red team exercises.
Residency within the Washington, DC metropolitan area.
Direct experience configuring and implementing security controls in Check Point firewall environments.

Responsibilities

Conduct authenticated and unauthenticated vulnerability assessments across servers, endpoints, network devices, SQL Server, VDI, and AWS and Azure workloads.
Implement and validate technical remediation, secure configuration changes, system hardening, and vulnerability resolution.
Develop a risk-based vulnerability prioritization matrix using CVSS ratings, asset criticality, and exploitability.
Establish vulnerability remediation governance, including ownership models, SLA targets, closure standards, and escalation workflows.
Deliver a Vulnerability Remediation Governance Plan within the first 60 days.
Reduce the vulnerability backlog through root cause analysis, targeted remediation plans, direct technical remediation, and measurable tracking.
Configure, tune, and optimize Tenable Nessus scanning policies and infrastructure; troubleshoot credentialed-scan failures and address scanning coverage gaps.
Correlate vulnerability findings with Microsoft Sentinel, Varonis, and Splunk to validate results, identify discrepancies, and suppress false positives.
Improve vulnerability scanning accuracy, effectiveness, and reporting, and maintain technical and executive dashboards and metrics for MTTR, vulnerability aging, patch compliance, and security exceptions.
Configure, implement, and optimize patch management solutions using MECM, Ivanti, and Jamf; design patch deployment rings, maintenance windows, and automated workflows.
Develop and execute risk-based Windows and Linux server patching plans and implement endpoint and server security hardening.
Prepare, submit, and track change requests with implementation, testing, validation, and rollback documentation.
Update business continuity and disaster recovery documentation related to patch management.
Configure, implement, troubleshoot, and harden firewall policies, including remediation of misconfigurations, overly permissive rules, deprecated objects, and unnecessary access permissions through approved change control.
Apply enterprise firewall engineering experience with Check Point, Palo Alto Networks, or Cisco technologies, including in the customer's Check Point environment.
Configure and tune Microsoft Defender policies for Windows and macOS endpoints in alignment with NIST SP 800-53 Revision 5.
Assess, troubleshoot, and improve security configurations involving firewall rules and ACLs, NAT, DNS, network segmentation and routing, VPNs, proxy services, and IPS/IDS.
Conduct AWS and Azure cloud security posture reviews and implement approved configuration improvements.
Assess ZTNA gateway configurations and recommend and implement appropriate enhancements.
Configure and improve Microsoft Entra ID and Active Directory security controls, including Conditional Access, PIM, and MFA.
Identify and remediate identity and access management security gaps through approved configuration changes.
Support penetration tests and red team exercises, including findings validation and technical remediation.
Prepare Security Assessment Reports documenting identified risks, implemented remediation, and remaining security considerations.
Develop and maintain engineering runbooks, playbooks, SOPs, secure configuration baselines, technical implementation and validation procedures, and operational transition documentation.
Prepare weekly project status reports and monthly patch compliance and vulnerability management reports.
Provide critical vulnerability notifications in accordance with customer-defined SLAs.
Document configuration changes, remediation outcomes, and deliverables to support operational continuity and audit readiness.

Benefits

Medical benefits
Dental insurance
Vision insurance
Life insurance
Health savings account
Short- and long-term disability
Employee assistance program (EAP)
Parental leave
401(k)
Paid time off for vacation
Company-paid holidays
Employees may be eligible for overtime, shift differential, and a discretionary bonus, depending on the position.