Vulnerability Identification Analyst

Bank of America • Washington, DC

2d • $100,000 - $141,300 • Onsite

About The Position

The Vulnerability Identification Analyst is an individual contributor on Bank of America’s GIS Vulnerability Identification Assurance (VIA) Vulnerability Identification team. The role helps implement, manage, and monitor infrastructure vulnerability identification efforts that protect the confidentiality, integrity, and availability of business information assets. It establishes processes and controls using Tanium to monitor CVE-based vulnerabilities and associated risk on technology for which GIS tools or effective automated scanning signatures are unavailable. The analyst works with stakeholders, Product Owners, and Software Engineers on data requirements, quality-control (QC) performance, research, and troubleshooting. The position typically requires 3–5+ years of relevant experience.

The role focuses on identifying and analyzing CVE-based vulnerabilities, validating enterprise scan data, assessing risk, and communicating findings in terms that technical and business stakeholders can understand. It also contributes to improving detection processes, expanding technology-based identification and QC activities, and supporting reporting and closure evaluations. The listed locations are Denver, Colorado; Washington, DC; and Chicago, Illinois. The role is in-office under the company’s stated in-office culture and provides role-specific flexibility based on responsibilities and business needs. Occasional weekend coverage is required; the schedule is first shift, 40 hours per week.

Requirements

• 3–5+ years of experience in information security and/or data management roles.
• 3–5+ years of experience with vulnerability management and/or assessment.
• Experience with CVE vulnerability analytics, including CVE-based vulnerability identification and risk analysis.
• Ability to analyze QC data and determine overall risk.
• Ability to creatively solve difficult problems to improve enterprise risk visibility and risk reduction.
• Good communication skills, including translating technical cybersecurity threats and risks into business-line understanding and execution, and proposing countermeasures to senior technology executives.
• Ability to explain analytics in plain English and communicate associated risk.
• Ability to work independently with little oversight, self-direct toward assigned goals, and learn in a fast-paced, changing environment.
• Broad technical background with security technologies, including server and workstation operating systems, network security, vulnerability scanning engines, and compliance management solutions.
• Strong PC and data-management skills, including Microsoft Office applications such as Excel.
• Ability to validate and analyze scan data returned by enterprise tools.
• Ability to see cross-team organizational needs, build consensus, and drive results.
• Occasional weekend coverage is required.

Nice To Haves

• Bachelor’s and/or master’s degree in Computer Science, Information Technology, or a related field.
• Strong analytical, problem-solving, and conceptual-thinking skills.
• Ability to communicate effectively with technical and non-technical business owners.
• Experience assisting with internal efficiency projects and development.

Responsibilities

• Discover and analyze CVE-based vulnerability findings and route them to reporting workstreams.
• Perform targeted QC on reported vulnerabilities and on the scope of the inventory being assessed.
• Review existing Tanium vulnerability detection processes and identify ways to streamline and improve efficiency.
• Investigate potential technology-based identification reporting issues raised by stakeholders or their representatives.
• Lead sustainable activities associated with required VAI QC technology-based identification P2 closure evaluations.
• Support expansion of technology-based identification activities for GIS.
• Support expansion of QC to cover workstation and ATM vulnerabilities currently fed by non-GIS teams.
• Work with stakeholders, Product Owners, and Software Engineers to implement data requirements, analyze QC performance, conduct QC research, and troubleshoot issues.
• Validate and analyze scan data returned by the enterprise toolset.
• Identify and develop proposals for program improvement.
• Perform other related duties and special assignments as needed or assigned.

Benefits

• Benefits eligible.
• Access to paid time off.
• Annual discretionary incentive plan eligibility; awards depend on individual performance and behaviors, line-of-business and/or group performance and contributions, and overall company success.
• The company describes its benefits as supporting employees’ physical, emotional, and financial wellness through affordable, competitive, and flexible benefits.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed