Vulnerability/Threat Management Analyst

Revinate•Atlanta, GA

2d•Remote

About The Position

Revinate is seeking a Vulnerability Management Analyst to take ownership of a critical engine within its growing security program. This role is responsible for the vulnerability management pipeline, from scan to ticket to fix, aiming to reduce the attack surface of a cloud-based hospitality SaaS platform. The position is defensive at its core, utilizing offensive knowledge to confirm exploitability and measuring success by complete scan coverage, clean prioritization, and vulnerability remediation. The role involves building automation to transform scan results into actionable insights and prioritized tickets for remediation teams.

Requirements

Hands-on, real-world experience running vulnerability management in a business environment, ideally with Tenable (experience with Qualys, Rapid7 InsightVM, or Kenna also translates).
Experience working in public cloud environments (AWS, Azure, or GCP), including the ability to set up test infrastructure to validate findings.
Strong scripting skills for automating scan-to-ticket workflows (Python is a plus).
A working knowledge of offensive security techniques, at the level of PenTest+ or OSCP, sufficient to confirm whether a finding is genuinely exploitable.
Experience with remediation ticketing workflows (Jira) and endpoint security tooling.
Certifications such as CompTIA CySA+ or GIAC GEVA (most valued), or Security+, GSEC, PenTest+, OSCP, or SSCP are a plus, not a requirement.
Proven hands-on experience matters most.
A background in security compliance, security operations, or application security.

Nice To Haves

Hands-on time with CrowdStrike Falcon Complete will make you stand out.
Candidates must reside in the Greater Atlanta area.

Responsibilities

Run continuous vulnerability scanning in Tenable and Crowdstrike Falcon to ensure all assets in the public cloud environment are inventoried, covered, and assessed.
Prioritize findings based on real-world risk, considering exploitability, threat intelligence, and asset context, rather than solely relying on CVSS severity scores.
Validate high-priority findings hands-on by setting up test virtual machines or using AI-assisted tools to confirm exploitability in test environments.
Automate the process from finding to ticket using existing tools.
Push validated fixes through remediation teams via the ticketing workflow (Jira) and follow up to ensure SLAs are met.
Assist in defining vulnerability management standards and reporting on program health.
Participate in the mandatory on-call rotation for security incident response.
Wear multiple hats on a lean team, contributing to security compliance, operations, or application security as needed.