Vulnerability Management Analyst

Cathay Bank•Rosemead, CA

23h

About The Position

The Vulnerability Management Analyst supports Cathay Bank’s enterprise vulnerability management program, primarily by operating and optimizing the Tenable platform. The role maintains accurate asset visibility; configures and monitors vulnerability and discovery scans; manages Tenable agents and scan infrastructure; analyzes and prioritizes findings; coordinates remediation with technology owners; validates closure; and produces risk-based reporting. It also maintains evidence, exceptions, procedures, and metrics for governance, audit, regulatory, and management oversight. The analyst administers Tenable.io or Tenable Vulnerability Management, including scan policies, schedules, repositories, permissions, dashboards, tags, and reporting. The role maintains authenticated and discovery scans, agents, scanners, and related infrastructure; monitors platform health and scan performance; and reconciles Tenable inventory with authoritative asset sources. It reviews findings for accuracy and business impact, prioritizes risk using established risk metrics and threat intelligence, coordinates remediation, validates corrective actions, and maintains documented exceptions and risk acceptances. The role produces vulnerability dashboards and reports, maintains procedures and evidence repositories, supports audits and regulatory reviews, monitors remediation service levels, escalates material risks, and recommends improvements to platform configuration, coverage, automation, reporting, integrations, and processes. The position has no direct reports.

Requirements

At least 5 years of experience in vulnerability management, cybersecurity operations, security engineering, infrastructure security, or a related role.
At least 3 years of hands-on experience with vulnerability management tools, focused on Tenable.io or Tenable Vulnerability Management, including scan configuration, agent and scanner administration, asset tagging, dashboards, reporting, and troubleshooting.
Experience conducting authenticated and unauthenticated vulnerability scans across Windows, Linux, network, database, application, cloud, and endpoint environments.
Experience analyzing vulnerabilities, prioritizing risk, coordinating remediation, validating closure, and managing exceptions or risk acceptances.
Experience integrating or reconciling vulnerability data with ServiceNow, CMDB, Active Directory, SCCM, Intune, APIs, or other enterprise asset sources.
Experience producing vulnerability metrics and executive reporting in a formal IT governance, audit, regulatory, or compliance environment.
Advanced working knowledge of Tenable scan policies, credentials, agents, scanners, asset tags, access groups, dashboards, reports, plugins, and troubleshooting.
Strong understanding of vulnerability management lifecycle practices, CVSS, Tenable Vulnerability Priority Rating, Asset Criticality Rating, known-exploited vulnerabilities, threat intelligence, and risk-based prioritization.
Knowledge of authenticated scanning, network discovery, agent-based assessment, credential management, scan tuning, and ways to improve asset and vulnerability coverage.
Knowledge of configuring and using Tenable compliance scans to assess security control implementation and measure cybersecurity maturity against the CIS Critical Security Controls framework and applicable CIS Benchmarks.
Ability to analyze findings, identify likely false positives, determine remediation options, communicate technical risk, and validate corrective action.
Knowledge of Windows, Linux, network devices, databases, cloud platforms, enterprise applications, and endpoint management technologies.
Ability to reconcile and normalize asset data across Tenable, ServiceNow CMDB, Active Directory, SCCM, Intune, and other inventory sources.
Strong data-analysis and reporting skills, including operational dashboards, vulnerability aging metrics, service-level reporting, risk trends, and executive summaries.
Understanding of change management, exception management, risk acceptance, audit evidence, and regulated-environment control requirements.
Strong organizational, documentation, analytical, and problem-solving skills, with close attention to data quality and follow-through.
Effective written and verbal communication skills and ability to coordinate remediation across technical teams, business owners, vendors, and management.

Nice To Haves

Bachelor’s degree in information technology, Computer Science, Information Systems, Cybersecurity, or a related field preferred.
Relevant certifications are a plus, particularly Tenable certifications, Security+, CySA+, CISSP, or comparable vulnerability management, cybersecurity, or systems administration credentials.
Banking or financial-services experience preferred.
Familiarity with other vulnerability management, security scanning, and remediation tools is valued.
Familiarity with ServiceNow Vulnerability Response or similar remediation workflow and issue-tracking platforms is preferred.

Responsibilities

Administer and optimize Tenable.io or Tenable Vulnerability Management, including scan policies, schedules, repositories, permissions, dashboards, tags, and reporting.
Configure and maintain authenticated vulnerability scans, discovery scans, Tenable agents, scanners, and related scan infrastructure.
Monitor scanner and agent health, scan completion, credential failures, plugin currency, performance, and platform capacity; troubleshoot issues through resolution.
Maintain asset tags, scan targeting, network ranges, exclusions, and ownership mappings to support accurate segmentation and reporting.
Reconcile Tenable asset inventory with sources such as Active Directory, SCCM, ServiceNow CMDB, and network inventories; investigate coverage gaps and duplicate or stale records.
Review scan results for accuracy, severity, exploitability, asset criticality, exposure, and business impact; identify false positives, accepted risks, compensating controls, recurring findings, and urgent vulnerabilities.
Prioritize remediation using CVSS, Tenable Vulnerability Priority Rating, Asset Criticality Rating, known-exploited vulnerability information, threat intelligence, and internal risk criteria.
Analyze vulnerabilities across operating systems, applications, databases, network devices, cloud assets, and other in-scope technologies; track aging, service levels, overdue findings, recurring issues, and risk trends.
Assign and communicate actionable findings to infrastructure, application, cloud, database, network, and endpoint owners; coordinate remediation plans, dates, dependencies, and escalations.
Partner with patch management and system owners to confirm corrective actions address vulnerabilities without creating unacceptable operational risk.
Perform rescans or other validation to confirm remediation effectiveness and document closure evidence.
Maintain documented exceptions and risk acceptances with defined scope, justification, compensating controls, approvals, and expiration dates.
Produce recurring vulnerability dashboards and reports covering asset coverage, critical findings, aging, remediation performance, exceptions, and emerging risk.
Maintain vulnerability management procedures, scan standards, asset coverage documentation, operating runbooks, ownership records, and evidence repositories.
Support audits, regulatory reviews, risk assessments, and control testing with complete, traceable evidence.
Monitor adherence to remediation service levels and escalate material risks under governance and issue-management requirements.
Recommend improvements to Tenable configuration, scan coverage, automation, reporting, integrations, and vulnerability management processes.