Vulnerability Management & ACAS Administrator

Leidos•Fort Belvoir, VA

4d•Onsite

About The Position

Leidos is seeking a Vulnerability Management & ACAS Administrator to support large-scale operations on a Department of War contract in Fort Belvoir, Virginia. The I3TS program provides enterprise-wide IT support to the Defense Threat Reduction Agency’s Information Management & Technology Directorate, helping consolidate, modernize, and continuously improve IT services and mission capabilities for partners in CONUS and OCONUS locations. The selected candidate will serve as the program’s primary ACAS subject-matter expert and technical lead for vulnerability scanning across NIPRNet, SIPRNet, and JWICS. This experienced, independent professional will oversee daily ACAS operations; maintain scanner health and asset coverage; analyze and report findings; and coordinate vulnerability remediation with system owners and technical teams. The role also supports STIG compliance, develops and maintains operating documentation, and provides technical guidance on vulnerability trends, remediation priorities, and operational risk.

Requirements

Bachelor’s degree and 7+ years of relevant cybersecurity, vulnerability-management, systems-administration, or information-assurance experience; additional relevant experience may substitute for a degree.
At least 7 years of hands-on experience serving as an ACAS/Nessus subject-matter expert in a large enterprise or Department of War environment.
Experience administering and operating ACAS/Nessus infrastructure, including scanner deployment, configuration, health monitoring, scan-policy administration, plugin management, credentialed scanning, troubleshooting, and reporting.
Experience managing vulnerability-scanning operations across multiple security domains, including NIPRNet, SIPRNet, and JWICS, or comparable enterprise environments.
Experience analyzing vulnerability findings, validating scan results, identifying false positives, prioritizing remediation, and verifying closure.
Experience developing vulnerability-management reports, metrics, dashboards, and leadership-level status products.
Experience coordinating remediation with system administrators, network teams, endpoint-security teams, and system owners.
Working knowledge of Microsoft Windows, Linux, virtualization technologies, networking concepts, and enterprise endpoint environments.
Working knowledge of STIG compliance, SCAP Compliance Checker (SCC), STIG Viewer, secure configuration baselines, and security-hardening practices.
Must meet DoD 8570.01-M Information Assurance Technical (IAT) Level II baseline certification requirements; acceptable certifications include CompTIA Security+ CE or a higher-level certification that satisfies the requirement.
Must meet applicable DoD 8140 Cyberspace Workforce Qualification Program requirements for assigned DoD Cyber Workforce Framework work roles, as required by the contract and customer.
Must currently possess and maintain an active TS/SCI clearance.
Strong written, verbal, organizational, analytical, and problem-solving skills.
Ability to work independently as the program’s primary ACAS technical lead while coordinating effectively with cross-functional technical teams.

Nice To Haves

Tenable Assured Compliance Assessment Solution (ACAS) 201 certification.
Experience integrating or correlating ACAS data with asset-management, endpoint-security, configuration-management, ticketing, or vulnerability-tracking tools.
Experience using Tanium, Trellix, Microsoft Defender for Endpoint, or comparable endpoint-security and endpoint-management platforms to support vulnerability remediation and asset validation.
Experience developing automated reports, dashboards, or data-analysis products using PowerShell, Python, SQL, or similar tools.
Experience supporting vulnerability exception management, risk-acceptance workflows, Plans of Action and Milestones, and remediation governance.
Relevant Tenable, vulnerability-management, Microsoft, Linux, or cybersecurity certifications.

Responsibilities

Serve as the primary technical lead and subject-matter expert for ACAS and Nessus vulnerability-scanning operations across NIPRNet, SIPRNet, and JWICS.
Administer, operate, maintain, and troubleshoot ACAS/Nessus infrastructure, including scanners, configurations, schedules, policies, plugins, credentials, and management components.
Maintain scanning capability, asset coverage, scanner health, and vulnerability-data quality across supported environments.
Plan, coordinate, and execute authenticated and unauthenticated vulnerability scans according to approved schedules, operational requirements, and maintenance windows.
Analyze scan results, validate findings, identify false positives and duplicate findings, address scan-quality issues, and assess potential impact to systems and mission operations.
Prioritize vulnerabilities according to severity, operational impact, exploitability, asset criticality, and remediation timelines.
Coordinate with system administrators, network engineers, endpoint-security personnel, and system owners to facilitate remediation and verify closure.
Track vulnerabilities, remediation actions, exceptions, findings, and status in approved tracking systems.
Develop and maintain vulnerability-management metrics, dashboards, trend analysis, and recurring reports for technical personnel, program leadership, and customer stakeholders.
Identify and resolve ACAS coverage gaps, credentialed-scan failures, connectivity issues, scanner-performance issues, and asset-inventory discrepancies.
Support STIG compliance by correlating ACAS findings with hardening requirements and remediation actions.
Develop and maintain ACAS standard operating procedures, operating instructions, scan procedures, troubleshooting guides, and knowledge articles.
Coordinate ACAS maintenance, upgrades, configuration changes, and technical support with infrastructure, network, endpoint, and cybersecurity teams.
Provide technical guidance to leadership and stakeholders on ACAS capabilities, vulnerability trends, remediation priorities, and operational risk.
Independently manage competing requirements and meet short-, mid-, and long-term vulnerability-remediation timelines.