Vulnerability Management​/ACAS Response Analyst; Senior

DecisionPoint seeks a Senior Vulnerability Management / ACAS Response Analyst to support vulnerability identification, prioritization, remediation coordination, and compliance reporting for the USMEPCOM ENLIST program.

The Vulnerability Management / ACAS Response Analyst will analyze Assured Compliance Assessment Solution (ACAS) results provided by Government personnel, assess and prioritize findings, and coordinate remediation activities across infrastructure and application teams. This role will track remediation owners, corrective actions, deadlines, and supporting evidence through closure.

The analyst will also track Information Assurance Vulnerability Alert (IAVA) and Information Assurance Vulnerability Management (IAVM) compliance, maintain Plans of Action and Milestones (POA&Ms), elevate unresolved vulnerabilities, coordinate Government rescans, and review rescan results to validate and document closure.

This position is remote, with a preference for candidates located in the Chicago area.

Note: By applying to this position, you acknowledge and consent to having your resume included in an active competitive government contract bid.

The Vulnerability Management / ACAS Response Analyst will:

• Review and analyze ACAS vulnerability-scan results provided by Government civilian personnel.

• Validate findings and prioritize vulnerabilities based on severity, exploitability, asset criticality, mission impact, exposure, and applicable Government requirements.

• Identify affected systems, applications, devices, and organizational owners associated with reported vulnerabilities.

• Assign and coordinate remediation actions with infrastructure, application, operations, engineering, and Government teams.

• Establish remediation deadlines and track findings through mitigation, approved exception, risk acceptance, or validated closure.

• Track compliance with applicable IAVAs and IAVM requirements.

• Maintain accurate vulnerability records, remediation status, due dates, responsible owners, risk decisions, and supporting evidence.

• Create and continuously update system- or program-level POA&Ms for identified vulnerabilities.

• Escalate overdue, high-risk, repeatedly identified, or unresolved vulnerabilities to cybersecurity and program leadership.

• Coordinate Government rescan requests after remediation activities have been completed.

• Review rescan results to confirm that corrective actions were successful and vulnerabilities are no longer present.

• Document vulnerability closure and retain traceable supporting evidence in the designated Government repository.

• Identify false positives, duplicate findings, accepted risks, operational dependencies, and remediation constraints and route them for appropriate Government review.

• Review Endpoint Security Solutions reports and coordinate remediation of applicable endpoint-security findings.

• Monitor vulnerability aging, remediation performance, compliance rates, recurring findings, and risk trends.