Senior Vulnerability Management Lead

Chenega Systems•Washington, DC

18h•$119,700 - $150,000•Onsite

About The Position

The Senior Vulnerability Management Lead performs assessments of systems and networks within the enterprise environment and identifies where those systems/networks deviate from acceptable configurations, organizational policy, and/or local policy. This role also measures the effectiveness of defense-in-depth architecture against known vulnerabilities.

Requirements

Bachelor’s degree in Cybersecurity, Information Technology, Engineering, or a related field
Additional years of experience may be used in lieu or a degree
5+ years of experience in cybersecurity with direct ownership or leadership of a vulnerability or exposure management program in an enterprise environment
CompTIA Security+, ISC(2) SSCP, or comparable industry certification
Must be a U.S. Citizen
Must be able to pass a Criminal and Financial Background Check and drug screening prior to starting
Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).
Knowledge of how traffic flows across the network (e.g., Transmission Control Protocol [TCP] and Internet Protocol [IP], Open System Interconnection Model [OSI], Information Technology Infrastructure Library, current version [ITIL]).
Knowledge of application vulnerabilities.
Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).
Knowledge of what constitutes a network attack and a network attack's relationship to both threats and vulnerabilities.
Knowledge of penetration testing principles, tools, and techniques.
Skill in conducting vulnerability scans and recognizing vulnerabilities in security systems.
Skill in using network analysis tools to identify vulnerabilities (e.g., fuzzing, Nmap, etc.).
Skill in conducting application vulnerability assessments.

Nice To Haves

Master’s degree in Cybersecurity, Information Technology, Engineering, or a related field
5+ years of experience in cybersecurity with direct ownership or leadership of a vulnerability or exposure management program in an enterprise environment
ISC(2) CISSP, ISACA CISA, or comparable advanced industry certifications
Hands-on experience with vulnerability management platforms such as Rapid7, Tenable, Wiz, or similar solutions
Experience integrating vulnerability data with CMDB, asset inventory systems, and security telemetry sources
Experienced with automation and scripting for operational efficiency (e.g., PowerShell, Python)
Ability to drive execution and accountability across multiple teams without direct authority.
Strong written and verbal communication skills, with the ability to translate technical issues into business risk language.
Demonstrates flexibility and responsiveness to changing priorities and critical security needs.

Responsibilities

Analyze the organization's cyber defense policies and configurations and evaluate compliance with regulations and organizational directives.
Maintain deployable cyber defense audit toolkit (e.g., specialized cyber defense software and hardware) to support cyber defense audit missions.
Maintain knowledge of applicable cyber defense policies, regulations, and compliance documents specifically related to cyber defense auditing.
Prepare audit reports that identify technical and procedural findings and provide recommended remediation strategies/solutions.
Perform technical (evaluation of technology) and nontechnical (evaluation of people and operations) risk and vulnerability assessments of relevant technology focus areas (e.g., local computing environment, network and infrastructure, enclave boundary, supporting infrastructure, and applications).
Perform and coordinate scans on different types of assets within an organization, such as cloud services and on-premises networks.
Prepare summary reports that are compiled from newly discovered and existing vulnerabilities.
Report risk levels to the other teams to address them appropriately.
Offer insights on trends to guide future vulnerability management analyst roles and responsibilities improvements.
Other duties as assigned