Senior Vulnerability Analyst

Seeking an experienced Vulnerability Management professional to lead enterprise vulnerability identification, risk analysis, prioritization, and remediation across infrastructure, applications, endpoints, cloud, and containers.

Key Responsibilities

• Manage vulnerability data from scanners and vulnerability management platforms.
• Prioritize vulnerabilities using CVSS, EPSS, KEV, CWE and business risk.
• Track and drive remediation of high-risk vulnerabilities and SLA escalations.
• Develop dashboards, KPIs, KRIs, reports using Excel and reporting tools.
• Validate findings, analyze exploitability, and identify false positives/detection gaps.
• Partner with application, infrastructure, Threat Intelligence, and Security Operations teams.
• Manage risk acceptance, governance, audit, and compliance activities.
• Identify and implement vulnerability management process improvements.

Required Skills

• 5+ years of experience in Cybersecurity / Vulnerability Management / Security Operations.
• Strong knowledge of CVSS, EPSS, KEV, CWE, OWASP Top 10.
• Advanced Microsoft Excel skills including Power Query and Pivot Tables.
• Experience with Tenable, Qualys, Rapid7, or similar vulnerability scanners.
• Experience with Nucleus Security or similar vulnerability management platforms.
• Windows server/workstation vulnerability assessment experience.
• Knowledge of MSRC, GitHub Security Advisories, Nmap, OWASP ZAP, Nuclei.
• Understanding of PKI, encryption, digital signatures, DNS, and web technologies.
• Strong communication, analytical, and stakeholder-management skills.

Preferred Skills

• Python or PowerShell automation.
• LLM/AI-assisted vulnerability analysis.
• SBOM, container security, dependency management.
• Cloud Security Posture Management (CSPM).
• MITRE ATT&CK and cyber kill-chain concepts.
• Dynamic security analysis and AI-enabled security assessment tools.

Education: Bachelor's degree in Cybersecurity, Computer Science, IT, or related field, or equivalent experience. Security+, CySA+, GSEC, CISSP, or equivalent certifications are preferred.