Vulnerability Management Analyst

Vanguard•Malvern, PA

21h•Hybrid

About The Position

Vanguard is seeking a Vulnerability Management Analyst to help develop its attack surface management capabilities. The role combines security risk management, automation, and emerging AI-driven capabilities. The analyst identifies, prioritizes, and manages vulnerabilities across Vanguard’s hybrid infrastructure, supports adherence to security hardening standards, and integrates AI-assisted remediation tooling. The position works in a growing, fast-paced, cross-functional team to protect Vanguard and its clients from cybersecurity threats. The analyst monitors assets for vulnerabilities and security configuration weaknesses as part of Continuous Threat Exposure Management (CTEM), and automates aspects of vulnerability operations to help defend against AI-driven threats. The role partners with security and technology teams to validate potential vulnerabilities, advise on mitigation and compensating controls, investigate false positives and risk-rating or risk-acceptance requests, and report remediation progress. It also contributes to enforcement controls and guardrails, handles time-sensitive zero-day investigations, coordinates scanning-tool improvements, and identifies opportunities for process improvement and automation. Vanguard’s hybrid working model is designed to support flexibility as well as in-person learning, collaboration, and connection. The company describes its culture as mission-driven and highly collaborative.

Requirements

At least 4 years of related work experience, such as managing vulnerabilities at scale and understanding security frameworks.
Expertise in at least one major cloud service provider.
Experience with CVSS or other frameworks for rating CVE vulnerabilities.
Prior experience automating processes.
An undergraduate degree in a related field or an equivalent combination of training and experience.
Strong problem-solving ability.
Solid communication skills and the ability to influence stakeholders.
Ability to own and lead cross-functional initiatives with limited oversight, including planning, execution, and outcome tracking.

Nice To Haves

Demonstrated passion for continuous learning.
Experience with scripting and automation.
Experience with telecom/networking, Windows, or Linux configurations.
Experience with Aqua, Palo Alto Prisma, Wiz, CrowdStrike, Tenable Nessus, or Qualys.
Experience with Claude Code/Codex or threat modeling.
Experience with risk controls and interacting with internal or external audit.

Responsibilities

Monitor Vanguard assets for vulnerabilities and security configuration weaknesses using exposure assessment platforms as part of CTEM implementation.
Automate aspects of vulnerability operations (VulnOps) to help defend against AI-driven threats.
Partner with the SOC, Cyber Threat Intel, Offensive Security Team, and other stakeholders to refine vulnerability prioritization and validate the impact of suspected vulnerabilities.
Advise asset owners on mitigation strategies and compensating controls, and provide timely, accurate reporting on remediation progress.
Investigate false positives and requests for risk acceptance or risk-rating adjustments.
Shape enforcement controls and guardrails.
During zero-day events, manage time-sensitive escalations, develop custom reports, and conduct special investigations through the vulnerability management lifecycle.
Coordinate with the Engineering platform team to tune scanning tools, improve visibility, and meet additional security objectives.
Improve processes and identify opportunities to automate, combine security findings from disparate sources, and make remediation-owner experiences more consistent.
Lead cross-functional initiatives, including planning, execution, and outcome tracking.