Senior Cyber Vulnerability Analyst

Amentum•Fort Meade, MD

7d•$130,000 - $180,000•Onsite

About The Position

Amentum is seeking a Senior Cyber Vulnerability Analyst to support DISA through its Intel and Cyber Division at Fort Meade, Maryland. The role supports a program delivering critical IT capabilities to the Department of Defense and contributes to engineering, integrating, deploying, and sustaining an innovative IT enterprise solution. The analyst serves as a subject matter expert in identifying, analyzing, prioritizing, and communicating vulnerabilities affecting mission systems, enterprise networks, and adversary-relevant technologies. The position combines technical analysis with intelligence tradecraft to turn vulnerability data and threat reporting into actionable risk assessments for senior leaders, system owners, and mission partners. The analyst works independently on complex, high-visibility problems and provides technical guidance across the organization and Intelligence Community. The position focuses on establishing and maintaining robust configuration baselines in a rapidly evolving operational environment, while navigating technical challenges and collaborating across integrated teams. The analyst also supports vulnerability management, incident response, threat intelligence, risk advice, technical communications, tools and process improvement, and mentorship of other analysts. The work schedule is eight hours per day, Monday through Friday. The employee works in a SCIF daily and may also work in a datacenter for specified periods. An active Top Secret clearance with SCI eligibility is required. This is designated as a safety-sensitive position and is contingent on successful completion of drug screening.

Requirements

Active Top Secret clearance with SCI eligibility.
Bachelor's degree in computer science, cybersecurity, information technology, engineering, or a related field, or equivalent experience. An advanced degree may substitute for experience; equivalent professional experience is typically four additional years in lieu of a degree.
At least 8 years of progressive experience in vulnerability analysis, penetration testing, reverse engineering, threat analysis, or related cybersecurity work; 6 years with a master's degree.
Experience with vulnerability scanners and assessment tools such as Nessus, Tenable, Qualys, Nmap, Metasploit, or Burp Suite.
Scripting experience in Python, PowerShell, or Bash.
Ability to write and brief clear, concise technical assessments for senior audiences.
Experience in reverse engineering, binary analysis, or exploit development, using tools such as IDA or Ghidra.
Experience with cloud security (AWS, Azure, or GCP), containers, or operational technology and industrial control systems.
Prior experience in an IC, DoD, or federal cyber mission environment.
Experience with enterprise-scale vulnerability management programs and vulnerability disclosure or equities processes.
Familiarity with analytic standards and structured analytic techniques.
At least one required certification: CISSP, OSCP, GCIA, GCIH, GREM, or CEH.
Experience with enterprise shared services, service management, or IT/business operations.
Experience with Agile, Lean, DevSecOps, or hybrid delivery methodologies.
Experience with enterprise transformation, modernization, data initiatives, or digital services.
Experience supporting federal acquisition, contracting, or vendor-management activities.
Familiarity with federal cybersecurity, risk-management, and information-assurance frameworks.
Experience developing executive dashboards, performance metrics, and organizational governance models.
Experience leading complex, enterprise-level initiatives involving multiple stakeholders and organizational functions.
Experience managing shared services, enterprise operations, or centralized support capabilities.
Experience in a federal government, defense, national security, or Intelligence Community environment.
Strong knowledge of project management methodologies, governance, risk management, and performance management.
Ability to lead through influence in matrixed organizations.
Excellent written, verbal, briefing, and executive communication skills, including the ability to brief technical and non-technical audiences.
Strong analytical, organizational, and problem-solving capabilities.
Ability to manage multiple priorities in a high-tempo, mission-focused environment.
Ability to work with sensitive and classified information in accordance with applicable security requirements.
Ability to work independently and lead small teams or workstreams while collaborating with multidisciplinary teams.
Experience developing and managing configuration baselines in complex technical environments.
Experience administering or supporting formal change control processes and Configuration Control Boards.
Experience with configuration status accounting, configuration audits, change tracking, and baseline management.
Ability to analyze technical information and assess the potential impact of proposed system changes.
Experience working in government or highly regulated environments.

Nice To Haves

Certified Information Security Manager (CISM).
Certified Information System Auditor (CISA).

Responsibilities

Analyze software, firmware, hardware, protocol, and configuration vulnerabilities, including root cause, exploitability, and potential mission impact.
Perform and oversee authorized vulnerability scanning, penetration testing, and red, blue, and purple team activities on Intelligence Community networks, systems, and enclaves.
Develop and refine risk-scoring methodologies using CVSS, exploit availability, asset criticality, and threat actor intent and capability.
Validate findings, eliminate false positives, and produce reproducible technical evidence.
Correlate vulnerabilities with all-source intelligence, adversary tactics, techniques, and procedures, and active campaigns to prioritize remediation.
Track exploitation trends, zero-day disclosures, and emerging attack surfaces, including cloud, supply chain, operational technology, and AI-enabled systems.
Contribute to finished intelligence products, technical bulletins, and threat advisories using IC analytic standards (ICD 203).
Participate in vulnerability equities and disclosure deliberations as directed by agency policy.
Prepare written assessments and executive briefings for technical and non-technical audiences, including senior leadership.
Advise system owners, authorizing officials, and program managers on mitigation strategies, compensating controls, and risk acceptance.
Support incident response by assessing exploited vulnerabilities and recommending containment and remediation actions.
Coordinate vulnerability information sharing with IC elements, DoD components, federal partners, and approved industry and international partners.
Represent the organization in working groups, technical exchanges, and community-of-interest forums.
Mentor and review junior and mid-level analysts, and lead technical training and knowledge-sharing sessions.
Develop and improve analytic tools, scripts, automation, and standard operating procedures.
Evaluate commercial and government vulnerability management tools and recommend adoption.
Develop and manage configuration baselines in complex technical environments.
Support formal change control processes and Configuration Control Boards, including configuration status accounting, audits, change tracking, and baseline management.
Analyze technical information and assess the potential impact of proposed system changes.
Fulfill applicable safety, quality, procedure-compliance, training, and emergency-response responsibilities.