Vulnerability Management Analyst

TIME Systems • Jb Andrews, MD

107d • Onsite

About The Position

TIME Systems is seeking a Vulnerability Management Analyst to join its Cybersecurity Operations team supporting the Air Force National Capital Region (AFNCR) Information Technology Services (ITS) program. The analyst will support enterprise vulnerability management operations across Department of Defense environments, including vulnerability assessments, DISA STIG compliance reviews, remediation coordination, and Risk Management Framework (RMF) compliance. The role works with cybersecurity engineers, ISSOs, system administrators, and engineering teams to strengthen security posture while supporting mission-critical AFNCR enterprise systems.

Requirements

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related technical discipline; equivalent education and experience may be substituted.
• At least four years of professional cybersecurity or systems administration experience, including at least one year supporting vulnerability management, ACAS, Nessus, or Tenable SecurityCenter.
• Active DoD Secret Security Clearance.
• Current CompTIA Security+ CE or higher certification meeting DoD 8570/8140 IAT Level II requirements.
• Hands-on experience performing vulnerability assessments using Tenable SecurityCenter, Nessus, or ACAS.
• Working knowledge of DISA STIGs, SCAP Compliance Checker (SCC), and secure system configuration practices.
• Understanding of RMF, NIST SP 800-53 security controls, POA&M management, and Air Force cybersecurity policies.
• Experience reviewing vulnerability findings, validating scan results, identifying false positives, and supporting remediation efforts.
• Strong analytical, troubleshooting, documentation, and organizational skills, with excellent attention to detail.
• Experience preparing technical reports, compliance documentation, vulnerability metrics, and executive summaries.
• Excellent written and verbal communication skills, with the ability to communicate technical information to technical and non-technical personnel.
• Ability to work independently and manage multiple priorities in a fast-paced cybersecurity operations environment.

Nice To Haves

• Experience supporting USAF, DoD, DISA, or other federal government cybersecurity environments.
• Experience with eMASS, SCAP Compliance Checker (SCC), HBSS, or other enterprise cybersecurity management tools.
• Experience supporting CCRI, CORA, or similar cybersecurity inspections.
• Knowledge of Continuous Monitoring (ConMon) processes and vulnerability lifecycle management.
• Experience developing PowerShell scripts, Nessus API integrations, or automation solutions to streamline vulnerability management.
• Familiarity with Microsoft Windows Server, Red Hat Enterprise Linux (RHEL), VMware, Active Directory, and enterprise network infrastructure.
• Understanding of cybersecurity risk assessment methodologies, CVSS scoring, threat prioritization, and risk-based remediation strategies.
• Experience supporting Authorization to Operate (ATO) packages, security control assessments, and continuous authorization activities.
• Demonstrated ability to collaborate across cybersecurity, engineering, and operations teams supporting mission-critical enterprise environments.

Responsibilities

• Perform vulnerability assessments using Tenable SecurityCenter, Nessus, and Assured Compliance Assessment Solution (ACAS) across classified and unclassified environments.
• Review scan results to identify and prioritize CAT I, CAT II, and CAT III vulnerabilities; validate findings and identify false positives.
• Coordinate remediation with system administrators, ISSOs, engineering teams, and Queue Managers.
• Support the development, maintenance, and tracking of Plans of Action and Milestones (POA&Ms) in accordance with RMF requirements.
• Validate and review DISA Security Technical Implementation Guides (STIGs), SCAP results, and secure configuration baselines.
• Prepare vulnerability assessment reports, compliance metrics, executive summaries, and dashboards for leadership reporting and cybersecurity readiness inspections, including CCRI and CORA assessments.
• Maintain ACAS asset inventories, credentialed scan configurations, asset groups, repositories, scan zones, and vulnerability data accuracy.
• Assist with vulnerability trend analysis, risk scoring, and continuous monitoring activities.
• Support cybersecurity audits, inspections, accreditation activities, and system authorization efforts by providing vulnerability documentation and evidence.
• Collaborate with cybersecurity engineers, system administrators, network engineers, and ISSOs to implement remediation strategies and security best practices.
• Maintain SOPs, vulnerability management processes, scan schedules, and operational procedures.
• Ensure compliance with DoD, Air Force, DISA, RMF, and organizational cybersecurity policies and standards.

Benefits

• Choice of three health plans, including a 100% company-funded employee-only plan.
• Dental coverage with no annual maximum.
• Vision coverage for regular eye exams and corrective eyewear.
• Life insurance, AD&D, and other customizable coverage options.
• 401(k) retirement plan.
• Health Savings Account (HSA) and Flexible Spending Account (FSA).
• Short- and long-term disability insurance.
• Employee Assistance Plan.
• Professional development opportunities in a supportive environment.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level