Vulnerability Management Analyst

Bain & Company•Boston, MA

11d•$61,000 - $80,000•Hybrid

About The Position

As a Vulnerability Management Analyst, you’ll operate and drive the day-to-day maturity of our vulnerability and exposure management program across a large, diverse global environment spanning servers, endpoints, network devices, containers, and multi-cloud workloads. You’ll work hands-on with our core tooling stack, including Qualys Vulnerability Management, Detection and Response (VMDR) for host and application scanning, Wiz for cloud and container posture, and Tanium for endpoint visibility and remediation. You’ll also lead a Continuous Threat Exposure Management (CTEM) program that turns findings from these tools into a single, risk-prioritized view of real exposure. Working closely with IT, infrastructure, cloud, and engineering teams, you’ll set remediation standards, drive accountability, guide junior analysts, and brief leadership on exposure and risk trends.

Requirements

3–5 years of hands-on experience in vulnerability management, exposure management, or closely related security operations, including experience in a lead capacity.
Deep understanding of the vulnerability management lifecycle, risk-based remediation, and SLA governance across large, complex environments.
Direct hands-on experience operating and administering Qualys VMDR, Wiz, and Tanium, including deployment, configuration, tuning, integration, and reporting. Experience with all three platforms is required.
Demonstrated experience running or materially contributing to a Continuous Threat Exposure Management program, including scoping, discovery, prioritization, validation, and mobilization.
Proficiency in CVSS analysis, EPSS, CISA KEV, and threat-intelligence-driven vulnerability prioritization.
Strong reporting and analytical capabilities, including Excel, pivot tables, and native security tool reporting, with the ability to produce technical and executive-level metrics.
Experience securing complex environments spanning Windows, Linux, network devices, endpoints, containers, and multi-cloud workloads.
Strong understanding of threat intelligence sources and the ability to correlate external threats with internal findings.
Excellent written, verbal, and presentation skills, with the ability to influence stakeholders, communicate risks to leadership, and mentor junior analysts.
Advanced English proficiency, with the ability to communicate effectively in professional and technical environments.

Nice To Haves

Knowledge of cloud security posture management (CSPM), cloud-native application protection platforms (CNAPP), and container or Kubernetes security concepts, ideally using Wiz or equivalent technologies.
Familiarity with CIS Benchmarks, secure configuration practices, and system hardening standards.
Experience with scripting and automation using Python, PowerShell, tool APIs, or Power Query.
Experience integrating vulnerability management tools with IT service management platforms, such as ServiceNow, to automate remediation workflows.
Qualys VMDR Certification
Wiz certification or equivalent cloud security/CNAPP certification
GIAC certification, such as GEVA or GCED, or Certified Ethical Hacker (CEH)
CISSP, Tanium, or CompTIA Security+, or progress toward these certifications

Responsibilities

Own and continuously improve the end-to-end vulnerability management lifecycle across the enterprise, including asset discovery, scanning, detection, validation, prioritization, remediation governance, rescanning, and closure verification.
Operate and administer our core exposure management tools, Qualys VMDR, Wiz, and Tanium, including deployment, configuration, tuning, integration, and scanner, agent, and sensor health.
Lead the Continuous Threat Exposure Management (CTEM) program, coordinating scoping, discovery, prioritization, validation, and mobilization activities while consolidating findings into a single, risk-ranked view of exposure.
Prioritize vulnerabilities using the Common Vulnerability Scoring System (CVSS), Exploit Prediction Scoring System (EPSS), CISA Known Exploited Vulnerabilities (KEV), threat intelligence, and business criticality.
Establish and enforce remediation service-level agreements (SLAs), partnering with IT, infrastructure, cloud, and engineering teams to drive accountability and resolve high-risk exposures.
Collaborate with threat intelligence teams to connect emerging threats with internal vulnerabilities and guide targeted remediation efforts.
Define and maintain exception and risk-acceptance standards, ensuring appropriate documentation for audits, compliance, and leadership reporting.
Develop and automate dashboards and reporting on vulnerability exposure, scan coverage, remediation progress, vulnerability aging, and SLA adherence using native reporting tools, Excel, and business intelligence solutions.
Mentor junior analysts, establish standards for triage and reporting, and serve as an escalation point for complex findings.
Provide recommendations on secure configurations, system hardening, and overall vulnerability management program maturity, communicating effectively with both technical teams and senior stakeholders.