Vulnerability Management / ACAS Response Analyst (Senior)

DecisionPoint | Cortek•Chicago, IL

2d•Remote

About The Position

DecisionPoint seeks a Senior Vulnerability Management / ACAS Response Analyst to support vulnerability identification, prioritization, remediation coordination, and compliance reporting for the USMEPCOM ENLIST program. The analyst reviews Assured Compliance Assessment Solution (ACAS) results provided by Government personnel, assesses and prioritizes findings, and coordinates remediation across infrastructure and application teams. The role tracks remediation owners, corrective actions, deadlines, and supporting evidence through closure. The analyst tracks Information Assurance Vulnerability Alert (IAVA) and Information Assurance Vulnerability Management (IAVM) compliance, maintains Plans of Action and Milestones (POA&Ms), escalates unresolved vulnerabilities, coordinates Government rescans, and reviews rescan results to validate and document closure. The position is remote, with a preference for candidates located in the Chicago area. Applicants acknowledge and consent to having their resume included in an active competitive government contract bid. By submitting a resume, applicants also authorize DecisionPoint Corporation to share it and personal information on it with subsidiaries, affiliates, and teaming partners for consideration for this and comparable positions.

Requirements

Active Secret clearance or higher.
Bachelor’s degree in Cybersecurity, Information Systems, or a related field.
Minimum of 10 years of relevant cybersecurity, information assurance, vulnerability-management, or information-security experience.
Current CompTIA Security+ certification.
Current CompTIA Cybersecurity Analyst (CySA+) certification.

Nice To Haves

Experience analyzing ACAS or Tenable vulnerability-scan results in a Department of Defense environment.
Experience coordinating vulnerability remediation across infrastructure, network, endpoint, application, database, cloud, and system-administration teams.
Knowledge of IAVAs, IAVM requirements, and associated reporting processes.
Experience creating and maintaining POA&Ms for cybersecurity vulnerabilities and compliance findings.
Experience prioritizing vulnerabilities using severity, exploitability, mission impact, asset criticality, and threat intelligence.
Experience coordinating rescans and validating remediation effectiveness using scan results and supporting technical evidence.
Familiarity with Endpoint Security Solutions, STIG Viewer, SCAP tools, eMASS, ServiceNow, or comparable cybersecurity and workflow platforms.
Knowledge of the DoD Risk Management Framework, NIST SP 800-53 controls, FISMA reporting, DISA Security Technical Implementation Guides, and applicable DoD cybersecurity directives.
Experience developing vulnerability metrics, aging reports, remediation dashboards, compliance summaries, and executive-level briefings.
Experience documenting false positives, mitigations, operational constraints, accepted risks, and technical closure evidence.
Additional certifications such as CASP+, CISSP, CISM, CGRC, PenTest+, or equivalent cybersecurity credentials.
Familiarity with current DoD 8140 cybersecurity workforce qualification requirements.
Strong analytical, prioritization, documentation, communication, and cross-functional coordination skills.
Ability to explain complex vulnerability findings and remediation risks to technical and nontechnical stakeholders.

Responsibilities

Review and analyze ACAS vulnerability-scan results provided by Government civilian personnel.
Validate findings and prioritize vulnerabilities based on severity, exploitability, asset criticality, mission impact, exposure, and applicable Government requirements.
Identify affected systems, applications, devices, and organizational owners associated with reported vulnerabilities.
Assign and coordinate remediation actions with infrastructure, application, operations, engineering, and Government teams.
Establish remediation deadlines and track findings through mitigation, approved exception, risk acceptance, or validated closure.
Track compliance with applicable IAVAs and IAVM requirements.
Maintain accurate vulnerability records, remediation status, due dates, responsible owners, risk decisions, and supporting evidence.
Create and continuously update system- or program-level POA&Ms for identified vulnerabilities.
Escalate overdue, high-risk, repeatedly identified, or unresolved vulnerabilities to cybersecurity and program leadership.
Coordinate Government rescan requests after remediation activities have been completed.
Review rescan results to confirm corrective actions were successful and vulnerabilities are no longer present.
Document vulnerability closure and retain traceable supporting evidence in the designated Government repository.
Identify false positives, duplicate findings, accepted risks, operational dependencies, and remediation constraints and route them for appropriate Government review.
Review Endpoint Security Solutions reports and coordinate remediation of applicable endpoint-security findings.
Monitor vulnerability aging, remediation performance, compliance rates, recurring findings, and risk trends.
Develop vulnerability-management reports, metrics, dashboards, risk summaries, and briefing materials for Government and program leadership.
Support reporting of USMEPCOM security compliance to applicable authorities and reporting structures.
Coordinate emergency or accelerated remediation activities for critical vulnerabilities and time-sensitive directives.
Verify that remediation evidence is complete, accurate, and sufficient to support closure.
Recommend process improvements that increase remediation efficiency, reduce recurring vulnerabilities, and improve reporting accuracy.
Support the development and maintenance of vulnerability-management procedures, standard operating procedures, workflows, and user guidance.