Vulnerability Management & ACAS Administrator

JCS Solutions LLC•Fort Belvoir, VA

2d•$70,000 - $100,000•Onsite

About The Position

JCS Solutions is seeking an experienced Vulnerability Management & ACAS Administrator to support a high-profile Department of War contract at Fort Belvoir, Virginia. The I3TS program provides enterprise-wide IT support to the Defense Threat Reduction Agency's Information Management & Technology Directorate, helping consolidate, modernize, and improve IT services and mission capabilities for CONUS and OCONUS mission partners. The role serves as the program's primary Assured Compliance Assessment Solution (ACAS) subject-matter expert and technical lead, responsible for vulnerability scanning across NIPRNet, SIPRNet, and JWICS. The administrator maintains scanner health and complete asset coverage, turns scan findings into actionable reporting, and coordinates with system owners and technical teams to remediate and confirm vulnerabilities. The position requires an active TS/SCI clearance, an active DoD 8140/8570 IAT Level II certification, and a bachelor's degree with at least eight years of relevant experience. The listed salary range is $70,000 to $100,000.

Requirements

At least 8 years of relevant cybersecurity, vulnerability management, systems administration, or information assurance experience.
At least 7 years of hands-on experience as an ACAS/Nessus subject-matter expert in a large enterprise or Department of War environment.
Experience operating ACAS/Nessus infrastructure, including scanner deployment, configuration and health monitoring, scan-policy administration, plugin management, credentialed scanning, troubleshooting, and reporting.
Experience managing vulnerability scanning across multiple security domains, including NIPRNet, SIPRNet, and JWICS, or comparable enterprise environments.
Experience analyzing findings, validating scan results, identifying false positives, prioritizing remediation, and verifying closure.
Experience developing vulnerability-management reports, metrics, dashboards, and leadership-level status products.
Experience coordinating remediation with system administrators, network teams, endpoint-security teams, and system owners.
Working knowledge of Microsoft Windows, Linux, virtualization, networking concepts, and enterprise endpoint environments.
Working knowledge of STIG compliance, SCAP Compliance Checker (SCC), STIG Viewer, secure configuration baselines, and security hardening.
Strong written, verbal, organizational, analytical, and problem-solving skills.
Ability to work independently as the program's primary ACAS technical lead while coordinating with cross-functional technical teams.
Active DoD 8140 IAT Level II certification, such as Security+ CE, CySA+, CASP+ CE, CCNA-Security, CCNP Security, CCSP, CISA, CISSP or Associate, CND, GCED, GCIH, GICSP, GSEC, or SSCP.
Bachelor's degree with at least 8 years of relevant experience.
Active TS/SCI clearance.

Nice To Haves

Tenable ACAS 201 certification.
Experience connecting or correlating ACAS data with asset-management, endpoint-security, configuration-management, ticketing, or vulnerability-tracking tools.
Experience using Tanium, Trellix, Microsoft Defender for Endpoint, or similar endpoint tools to support remediation and asset validation.
Experience building automated reports, dashboards, or data-analysis products with PowerShell, Python, SQL, or similar tools.
Experience supporting vulnerability exception management, risk acceptance workflows, Plans of Action and Milestones (POA&Ms), and remediation governance.
Other relevant Tenable, vulnerability-management, Microsoft, Linux, or cybersecurity certifications.

Responsibilities

Serve as the primary technical lead and subject-matter expert for ACAS and Nessus vulnerability scanning across NIPRNet, SIPRNet, and JWICS.
Administer, operate, maintain, and troubleshoot ACAS/Nessus scanners, scan configurations, schedules, policies, plugins, credentials, and associated management components.
Maintain scanning capability, asset coverage, scanner health, and vulnerability-data quality across supported environments.
Plan, coordinate, and run authenticated and unauthenticated scans according to approved schedules, operational requirements, and maintenance windows.
Analyze and validate scan results; identify false positives, duplicate findings, scan-quality issues, and potential impacts on systems and mission operations.
Prioritize vulnerabilities based on severity, operational impact, exploitability, asset criticality, and remediation timelines.
Coordinate with system administrators, network engineers, endpoint-security staff, and system owners to drive remediation and verify closure.
Track vulnerabilities, remediation actions, exceptions, and status in approved tracking systems.
Build and maintain vulnerability-management metrics, dashboards, trend analysis, and recurring reports for technical staff, program leadership, and customer stakeholders.
Identify and resolve coverage gaps, credentialed-scan failures, connectivity problems, scanner performance issues, and asset-inventory discrepancies.
Support STIG compliance by matching ACAS findings to hardening requirements and remediation actions.
Write and maintain ACAS standard operating procedures, operating instructions, scan procedures, troubleshooting guides, and knowledge articles.
Coordinate ACAS maintenance, upgrades, configuration changes, and technical support with infrastructure, network, endpoint, and cybersecurity teams.
Advise leadership and stakeholders on ACAS capabilities, vulnerability trends, remediation priorities, and operational risk.