Vulnerability Management & Security Analyst

Command Post Technologies, Inc.•Suffolk, VA

About The Position

Command Post Technologies, Inc. is seeking a Vulnerability Management & Security Analyst to provide day-to-day vulnerability scanning, STIG assessment, and remediation tracking for J7 JTSD cloud migration systems. Under the guidance of the Primary Government Project Lead and Lead Cybersecurity Specialist, the analyst will help ensure Azure workloads remain hardened and compliant with DoD standards. The role includes assessing Azure Government virtual machines and network components, evaluating compliance with DISA STIGs and SRGs, supporting remediation efforts, maintaining POA&M records in eMASS, and monitoring cloud security posture. The position requires U.S. citizenship, an active Secret clearance, qualifying education and DoW cybersecurity experience, practical ACAS/Tenable Nessus and STIG experience, and a current DoD 8570/8140 IAT Level II certification. Command Post Technologies describes itself as a Service-Disabled, Veteran-Owned Small Business that provides engineering services in cybersecurity, software development, test and evaluation, and strategic planning. The company describes its culture as team-oriented and grounded in integrity, determination, innovation, communication, accountability, and resourcefulness, with an emphasis on a healthy work-life balance.

Requirements

U.S. citizenship.
Active Secret clearance.
Bachelor’s degree in Information Technology, Cybersecurity, or a related field, plus at least 2 years of hands-on DoW cybersecurity analysis and vulnerability scanning experience; or an Associate's degree and 5 years of that experience; or a high school degree and 8 years of that experience.
Experience utilizing Assured Compliance Assessment Solution (ACAS) / Tenable Nessus for network, host, and credentialed scanning.
Practical experience applying and verifying DISA STIGs across Linux and Windows operating systems.
Current DoD 8570/8140 IAT Level II certification, such as CompTIA Security+ CE, CySA+, or GSEC.
Strong problem-solving skills and ability to troubleshoot complex issues.
Effective communication and collaboration skills.

Nice To Haves

Active Top Secret clearance with SCI eligibility.
Experience configuring and running ACAS scans inside Microsoft Azure Government or AWS GovCloud environments.
Experience utilizing PowerShell or Bash scripts to automate STIG finding verification and remediation.
Hands-on experience creating, updating, and closing POA&M entries directly in eMASS.
Familiarity with Microsoft Defender for Cloud, Secure Score tracking, and Azure Policy compliance states.
Strong technical documentation, briefing, and reporting experience.

Responsibilities

Conduct scheduled and ad hoc vulnerability assessments across Azure Government virtual machines and network components using ACAS (Tenable Nessus).
Evaluate and document system compliance against DISA Security Technical Implementation Guides (STIGs) and Security Requirements Guides (SRGs) using SCAP tools and STIG Viewer.
Collaborate with cloud and systems engineers to provide actionable remediation guidance for identified vulnerabilities and IAVAs.
Populate and maintain Plan of Action & Milestones (POA&M) records within eMASS to ensure accurate risk reporting to Authorizing Officials.
Monitor cloud security hygiene using Microsoft Defender for Cloud and DISA Continuous Monitoring dashboards.