Vulnerability Management Analyst

About the Job

Job Responsibilities:

* Support and maintain the University-wide vulnerability management program.

* Develop and manage remediation activities by ensuring departments mitigate vulnerabilities in a

timely manner based on risk.

* Help define vulnerability analysis, resolution strategy, and provide input to mitigation proposals.

* Initiate scans and other testing mechanisms as needed.

* Analyze root causes and propose feasible technical solutions to manage exposure to

vulnerabilities.

* Primary responsibility for administering vulnerability management tools.

* Prioritize and design various vulnerability management tool functions and features.

* Develop metrics to measure the effectiveness of the vulnerability management program and

mitigation strategies.

* Evaluate and implement technical options for enhanced visibility and decision-making by

stakeholders at multiple levels.

* Interface, influence, and engage the University's IT community to promote vulnerability

management across various levels of the organization.

* Provide guidance to comply with University policy and other relevant frameworks.

* Document, manage, and perform auditable procedures.

* Maintain strong knowledge of vulnerability management best practices and familiarity with

relevant frameworks (CVSS, OWASP Top 10).

* Escalate security issues where appropriate.

* The University of Minnesota is committed to fostering local talent through employment opportunities. While this position utilizes a predominantly remote work modality, prospective applicants must be located either in the state of Minnesota or near the Wisconsin border or otherwise open to relocation.

* Please note, this position is not eligible for H-1B or Green Card sponsorship.

At the University of Minnesota, we are dedicated to changing lives through education, research, and outreach. The University Information Security department (UIS) offers an environment of trust, collaboration, and mission-focused work. We seek an individual who will be responsible for providing guidance and support to the broader University IT community in detecting and addressing security vulnerabilities. This position will manage University vulnerability management tools and provide risk-based prioritization and consultative support to IT staff detecting and remediating security vulnerabilities to maintain compliance with information security policy.

We

Offer:

* University paid contribution (10% of your salary) to your retirement account - vested immediately.

* 22 paid vacation days per year, in addition to sick leave and 12 paid holidays.

* Reduced tuition opportunities covering 75% - 100% of eligible tuition.

* Excellent and affordable health care benefits (2023 Enrollment Guide).

* Wellbeing program with opportunity to earn lower health care rates.

* Free disability insurance and employer-paid life insurance.

* Public Service Loan Forgiveness (PSLF) opportunity.

* Financial counseling services.

* Employee Assistance Program with eight sessions of counseling at no cost.

* Employee Transit Pass with free or reduced rates in the Twin Cities metro area.

* Annual merit increase program.

Qualifications

* Please document qualifications on resume.

Required Qualifications:

* Bachelor's degree and 2 years of relevant work experience.

* Demonstrated experience in one or more of the following:

* Vulnerability Management

* Systems Administration

* Coding/scripting experience (e.g. python, powershell, etc.).

* Experience with deployment, maintenance and use of vulnerability scanning and testing tools (Rapid7, Tenable, Qualys or others).

* Experience collaborating with diverse teams

* Current technical knowledge and understanding of threats, emerging threats, and vulnerabilities.

* Ability to aggregate and analyze data and provide summaries of the data.

Preferred Qualifications:

* Understanding of vulnerability management analytical best practices and familiarity with relevant frameworks (CVSS, OWASP Top 10).

* Experience with vulnerability management governance structures in a large/decentralized organization.

* Knowledge or experience with relevant information security and regulatory frameworks such as CIS, PCI, HIPAA, NIST, CMMC.

* One…