Vulnerability Management Analyst - US Federal

Workday • Reston, VA

22h • $106,200 - $188,800 • Hybrid

About The Position

Workday Government, a wholly owned subsidiary serving the U.S. Government, is seeking a Vulnerability Management Analyst for its Governance, Risk and Compliance (GRC) team. The team supports compliance with U.S. Government security frameworks, including FedRAMP, IL-4, and CMMC. The analyst works with system owners and engineering teams to remediate security issues, interpret and prioritize findings from commercial scanning tools, contribute to Plans of Action and Milestones (POAMs), and communicate status to leadership.

Requirements

• Outstanding communication and organization skills.
• Be self-driven and motivated, with experience working with multiple stakeholders.
• Strong ability to understand and interpret results from commercial scanning tools and provide related remediation guidance.
• Strong ability to manage complex datasets in spreadsheets.
• Previous experience managing POAMs for FedRAMP-authorized environments.
• Working knowledge of security standards and frameworks such as FedRAMP, DoD IL-4/5, NIST 800-171, NIST 800-53, and the Risk Management Framework (RMF).
• Experience in cloud computing, preferably with a major hyperscaler such as AWS or Google.
• Proficiency with tools such as Jira for managing tickets and tasks.

Nice To Haves

• Relevant industry certifications, such as Security+, CEH, or CISSP.
• Previous experience as an assessor or Information Systems Security Engineer (ISSE) with a 3PAO or Cloud Services Provider (CSP).
• Previous experience with U.S. Federal Government defense or civilian agencies.
• Ability to write simple scripts, such as Python, to improve productivity.

Responsibilities

• Analyze and organize scan results and prioritize vulnerabilities for remediation based on risk requirements.
• Build relationships with engineering teams to track and report status and remediation timelines.
• Contribute to Plans of Action and Milestones (POAMs).
• Support Continuous Monitoring (ConMon) and participate in vulnerability-management audit activities.
• Report status to leadership teams.

Benefits

• May be eligible for the Workday Bonus Plan or a role-specific commission/bonus.
• May be eligible for annual refresh stock grants.
• Flexible work approach combining in-person time and remote work.

What This Job Offers

• Job Type: Full-time
• Education Level: No Education Listed