Vulnerability Manager

About the role

We are seeking a Vulnerability Manager to lead our client’s enterprise vulnerability management program. The role will oversee scanning platforms, analyze findings, and provide actionable reporting to leadership and compliance teams.

Key responsibilities

• Administer and maintain scanning platforms such as Tenable.SC, Qualys, and application‑based scanners, including policy configuration, asset grouping, credentialed scans, and agent deployment.
• Drive enterprise‑wide vulnerability scanning cadence across networks, systems, applications, and related assets.
• Analyze scan data, validate findings and false positives, and prioritize remediation using CVSS scores, exploitability, and business risk.
• Own the POA&M lifecycle, tracking remediation timelines, risk‑acceptance documentation, and closure validation.
• Develop and deliver weekly vulnerability metrics, dashboards, and executive reports covering trend analysis, SLA compliance, and risk posture.
• Support Authority‑to‑Operate (ATO) and continuous monitoring activities aligned with NIST 800‑53 and FISMA reporting requirements.
• Coordinate remediation efforts with system owners, IT operations, and patch‑management teams.
• Maintain scanner health, perform plugin/signature updates, and tune detection rules.
• Interact with GRC tools (e.g., CSAM) for daily and weekly vulnerability analysis.

Required profile

• Bachelor’s degree in a related field or equivalent experience.
• Minimum 6 years of experience as a Security Administrator, Vulnerability Manager, or equivalent role.
• Hands‑on experience administering Tenable or Qualys platforms.
• Deep familiarity with CVSS scoring and risk‑based prioritization methodologies.
• Excellent oral and written communication skills.
• Security+ certification (required); additional certifications are a plus.

Required skills

• Tenable (SC) and Qualys vulnerability scanning platforms.
• Burp Suite for application testing.
• CVSS scoring and risk prioritization.
• NIST 800‑53 security framework.
• FISMA compliance reporting.
• GRC tools such as CSAM.