Security Vulnerability Management Analyst

HYBRID IN NYC

Our client is looking for a Security Vulnerability Management Analyst that will perform vulnerability scans, assess vulnerabilities identified and prioritize their remediation; help review and enhance the current vulnerability management program. This position will interface between various Information Technology teams and this individual must be able to articulate the vulnerabilities and remediations to the stakeholders. Additionally this individual should also be able to translate the IT security requirements and constraints of the business into technical control requirements and specifications, help in coordinating the IT organization's technical activities to implement and manage security.

The Security Vulnerability Management Analyst is part of the Enterprise Information Technology Services, Information Security and Risk Management team and will work at an enterprise level to ensure a consistent delivery of information security and risk management services with focus on vulnerability management. This individual will act as a subject matter expert in vulnerability management.

• 10 years of IT experience, with at least 7 years dedicated to IT/Cyber Security, including Solution Design.
• 3-5+ years of experience with vulnerability scanning tools, preferably Rapid7; experience with vulnerability & patch assessment and strong knowledge of vulnerability scoring systems (CVSS/CMSS) and security frameworks like OWASP (Open Web Application Security Project), MITRE ATT&CK; good understanding of Windows and Linux patching.
• Excellent writing and communication skills to communicate findings and remediation status; knowledge of encryption algorithms, known vulnerabilities from alerts, advisories, errata and bulletins.

• Perform vulnerability scans across enterprise including the corporate data centers.
• Assess vulnerabilities identified by infrastructure and application scans, penetration testing, etc.
• Prioritize remediation of vulnerabilities discovered along with remediation timelines.
• Assist in providing support, planning and execution of remediation of vulnerabilities.
• Track and document vulnerabilities, create and maintain vulnerability management reports.
• Attend regular team meetings and facilitate meetings between stakeholders, project leaders, and IT teams on remediation of vulnerabilities.
• Assess vulnerabilities in cloud, containerized, and Dev Ops environments.
• Help improve and automate existing vulnerability management program.
• Stay current with vulnerability information across all products in environment, maintain knowledge of threat landscape.
• Assist in integrating vulnerability management system with third‑party solutions like Service Now and other products as needed.
• Work with stakeholders to identify information asset owners.
• Assist in identification of emerging security technologies and implement them as needed.
• Actively engage in security architecture solutioning.
• Keep informed on current threats and industry regulations.
• Attend team, management, and project meetings and provide verbal and written reports to Leadership Team.
• Develop strong working relationship with security engineering team to implement controls and configurations aligned with security policies and legal, regulatory and audit requirements.

• Must possess a high degree of integrity and trust, able to work independently and as part of a fast‑moving team.
• Strong knowledge of infrastructure, application and security protocols; configuration management techniques.
• Knowledge of network security architecture concepts, including topology, protocols, components, principles (e.g., defense‑in‑depth), traffic flows across the network (TCP/TCP‑IP, OSI, etc.).
• Experience with network access, identity, and access management (Active Directory, access federation, multifactor authentication, PKI).
• Experience with operating systems (Microsoft Windows, Linux, UNIX).
• Utilize/understand the use of open‑source tools such as Nmap, Shodan, and Metasploit to identify and confirm vulnerabilities and attack surface.
• Be able to create or modify scripts using frameworks such as Power Shell or…