Threat & Vulnerability Analyst

Horizon Blue Cross Blue Shield of New Jersey•Newark, NJ

1d•$97,800 - $133,455

About The Position

The Threat & Vulnerability Analyst works closely with Horizon’s Enterprise Business and Technology Solutions (EBTS) Division to develop, implement, and improve processes for identifying, assessing, and remediating vulnerabilities across the technology environment. The role performs internal and external vulnerability assessments, manages vulnerability scanning programs, establishes security standards, and evaluates exceptions and false-positive findings. The analyst helps reduce organizational risk by partnering with technology teams to prioritize and remediate vulnerabilities, developing long-term security solutions, and supporting threat intelligence and threat hunting initiatives. The role monitors emerging threats, industry standards, and security trends, and provides leadership with regular updates and recommendations about risks requiring remediation.

Requirements

High school diploma or GED required.
At least five years of Information Security experience required.
At least three years of experience focused on vulnerability identification, assessment, and remediation.
One or more of the following certifications is required or strongly preferred: CISSP, GCTI, GIAC certifications, CompTIA Security+, or Certified Ethical Hacker (CEH).
Strong understanding of cybersecurity frameworks and methodologies, including Cyber Kill Chain and Defense-in-Depth.
Comprehensive knowledge of vulnerability management and patch management processes and remediation approaches.
Deep understanding of indicators of compromise (IOCs), advanced persistent threats (APTs), cybercrime techniques, and attacker tactics, techniques, and procedures (TTPs).
Knowledge of Windows, Linux/Unix, and macOS operating systems.
Experience with vulnerability management platforms such as Nessus, Qualys, InsightVM (Nexpose), or similar solutions.
Knowledge of Center for Internet Security (CIS) benchmarks and Critical Security Controls.
Familiarity with threat intelligence platforms and sources such as Recorded Future, ThreatConnect/ThreatStream, H-ISAC, NJCCIC, or similar resources.
Understanding of cybersecurity audit, regulatory, and compliance requirements.
Ability to prioritize vulnerabilities and systems based on risk, asset criticality, and business impact.
Experience using CVSS scoring and risk-based vulnerability management methodologies.
Strong analytical, investigative, and problem-solving skills.
Excellent verbal and written communication skills, including presenting technical information to technical and non-technical audiences.
Experience creating executive-level dashboards, scorecards, and presentations using tools such as Microsoft PowerPoint, Visio, and Excel.
Experience developing and documenting security processes, standards, and procedures.
Ability to facilitate cross-functional collaboration and drive vulnerability remediation across multiple teams.
Experience negotiating remediation plans, exception requests, SLA extensions, and false-positive determinations.
Strong project management, organizational, and time-management skills.
Ability to manage multiple priorities in a fast-paced environment.
Demonstrated attention to detail and commitment to operational excellence.
Self-motivated, able to work independently, and able to maintain effective stakeholder communication.
Strong interpersonal skills and ability to build partnerships and influence outcomes across the organization.
Employees must live in New Jersey, New York, Pennsylvania, Connecticut, or Delaware.

Nice To Haves

Bachelor’s degree in Information Security, Cybersecurity, Computer Science, Information Technology, or a related field preferred; relevant experience may be considered in lieu of a degree.
Experience working within a large enterprise environment preferred.
Experience supporting security audits, regulatory compliance reviews, and risk management programs preferred.

Responsibilities

Develop and enhance vulnerability scanning strategies to provide comprehensive coverage across the enterprise environment.
Conduct internal and external vulnerability assessments and validate scan results.
Classify vulnerabilities by severity, exploitability, and business risk using established vulnerability management standards.
Categorize and prioritize assets according to criticality and organizational impact.
Partner with EBTS teams to develop and execute remediation plans in accordance with service level agreements (SLAs).
Track and report remediation activities to support timely resolution of identified vulnerabilities.
Analyze emerging cyber threats and assess their potential impact on Horizon’s technology environment.
Communicate current risk exposure, remediation efforts, and security recommendations to senior leadership and key stakeholders.
Develop, maintain, and present weekly and monthly vulnerability management metrics and executive reports.
Create, update, and maintain vulnerability management and threat intelligence policies, standards, procedures, and process documentation.
Ensure security controls, policies, and standards operate effectively to meet audit and regulatory requirements.
Support development and maturation of a threat hunting program by documenting threat scenarios, response playbooks, and use cases.
Collaborate with internal teams to investigate, validate, and resolve vulnerability findings, false positives, and remediation exceptions.
Support continuous improvement initiatives to strengthen the organization’s cybersecurity posture.