Vulnerability Management / ACAS Analyst (Journeyman)

DecisionPoint | Cortek•Chicago, IL

2d•Remote

About The Position

DecisionPoint seeks a Journeyman Vulnerability Management / ACAS Analyst to support vulnerability tracking, remediation coordination, and cybersecurity compliance reporting for the USMEPCOM ENLIST program. The position is remote, with a preference for candidates located in the Chicago area. Applicants acknowledge that their resume may be included in an active competitive government contract bid. The analyst reviews ACAS findings supplied by Government personnel, identifies affected assets and responsible teams, reconciles findings against authoritative inventory and configuration-management records, and coordinates corrective actions. The role tracks remediation tickets, owners, technical dependencies, deadlines, POA&M updates, and evidence through resolution. It also coordinates Government rescans, reviews results to verify remediation, and maintains vulnerability status information for reporting, compliance reviews, and cybersecurity inspections. The analyst supports prioritization and escalation of findings, documents false positives and approved risk decisions, reviews endpoint-security reports, prepares remediation metrics and briefing materials, and helps improve vulnerability-management procedures, tools, and workflows.

Requirements

Active Secret clearance or higher.
Bachelor’s degree in Cybersecurity, Information Systems, or a related field.
At least 7 years of relevant cybersecurity, information assurance, vulnerability-management, or information-security experience.
Current CompTIA Security+ certification.
Strong analytical, organizational, documentation, communication, and follow-through skills.
Ability to manage multiple findings, owners, dependencies, and deadlines in a structured compliance environment.

Nice To Haves

CompTIA Cybersecurity Analyst (CySA+) certification.
Experience reviewing ACAS or Tenable vulnerability-scan results in a Department of Defense environment.
Experience reconciling vulnerability findings against hardware, software, configuration-management, or asset-inventory records.
Experience coordinating vulnerability remediation with system administrators, infrastructure teams, and application support teams.
Knowledge of Information Assurance Vulnerability Alerts and Information Assurance Vulnerability Management requirements.
Experience creating and maintaining cybersecurity POA&Ms.
Experience using ServiceNow or another ticketing and workflow-management platform to track remediation activities.
Familiarity with Endpoint Security Solutions, STIG Viewer, SCAP tools, eMASS, or comparable DoD cybersecurity technologies.
Knowledge of the DoD Risk Management Framework, NIST SP 800-53 controls, DISA Security Technical Implementation Guides, and applicable DoD cybersecurity directives.
Experience collecting, reviewing, and maintaining technical evidence supporting vulnerability remediation and closure.
Experience coordinating rescans and reviewing results to verify successful remediation.
Experience preparing vulnerability reports, remediation metrics, aging summaries, dashboards, or inspection-support materials.
Familiarity with current DoD 8140 cybersecurity workforce qualification requirements.

Responsibilities

Review ACAS vulnerability findings provided by Government personnel.
Analyze findings to identify affected assets, systems, applications, devices, and responsible support teams.
Reconcile affected assets against configuration-management, inventory, and asset-management records, and research discrepancies with authoritative inventories.
Support vulnerability prioritization based on severity, asset criticality, mission impact, remediation deadlines, and Government direction.
Coordinate corrective actions with system administrators, infrastructure teams, application teams, engineers, and other remediation owners.
Create, update, and monitor vulnerability-remediation tickets in the designated workflow system.
Track owners, corrective actions, technical dependencies, target completion dates, and remediation status; follow up on updates and potential delays.
Collect and review documentation and other evidence supporting remediation completion.
Coordinate Government rescan requests and review Government-provided results to verify remediation.
Document validated closures and retain supporting evidence in the designated Government repository.
Track compliance with applicable Information Assurance Vulnerability Alerts and Information Assurance Vulnerability Management requirements.
Create and update POA&M entries for vulnerabilities requiring formal corrective-action tracking.
Maintain vulnerability status information for recurring reports, dashboards, compliance reviews, and cybersecurity inspections.
Identify overdue, high-risk, recurring, or unresolved findings and escalate them to the Senior Vulnerability Management / ACAS Response Analyst or cybersecurity leadership.
Track remediation dependencies involving patch availability, configuration changes, application testing, maintenance windows, or operational constraints.
Assist with documenting false positives, mitigating controls, operational dependencies, and Government-approved risk decisions.
Support review of Endpoint Security Solutions reports and tracking of applicable endpoint-security findings.
Develop vulnerability aging reports, remediation status summaries, compliance metrics, and supporting briefing materials.
Identify recurring vulnerabilities, process gaps, inaccurate asset records, and opportunities to improve remediation workflows.
Support maintenance of vulnerability-management procedures, standard operating procedures, tracking tools, and reporting templates.