Vulnerability Management Analyst- Secret Clearance Required Security Clearance

Security Clearance:
Active Secret clearance required (Interim ok). Travel Requirement:
Up to 10%. Citizenship: US Citizenship required.

Sherpa 6 is seeking a highly motivated and skilled Vulnerability Management Analyst to join our team. We build mission‑critical systems for the Department of Defense (DoD) and other commercial customers. The candidate will be responsible for identifying, assessing, prioritizing, and tracking remediation of security vulnerabilities across our software development process, partnering with infrastructure, application, and security teams to ensure risks are properly understood, addressed, and reported.

• Perform regular vulnerability scans across cloud, on‑prem, application, and endpoint environments.
• Work alongside Software and Dev Sec Ops  teams to develop strategies for incorporating vulnerability detection and management in CI/CD pipelines.
• Analyze scan results, validate findings, and assign severity based on industry standards (e.g., CVSS), business context, and exploitability.
• Work collaboratively with engineering and operations teams to drive timely remediation of vulnerabilities.
• Monitor external threat intelligence and evaluate emerging vulnerabilities (e.g., zero‑days, trending exploits).
• Maintain the vulnerability management platform and improve scanning coverage and accuracy.
• Support patch management processes and ensure alignment with remediation SLAs.
• Assist in developing and refining policies, procedures, and best practices for vulnerability management.
• Participate in incident response efforts when vulnerabilities contribute to active threats.

• 7+ years of experience in cybersecurity, vulnerability management, or related fields.
• 3+ years of experience working alongside software development and Dev Sec Ops  teams.
• Hands‑on experience with tools such as Tenable, Qualys, Rapid7, OpenVAS, or similar.
• Strong understanding of CVE, CVSS, NIST, CIS benchmarks, and vulnerability classification frameworks.
• Familiarity with cloud platforms (AWS, Azure, GCP).
• Ability to interpret vulnerability findings, identify actual risk, and communicate clearly with technical and non‑technical stakeholders.
• Knowledge of patch management practices and change management workflows.
• Understanding of network architecture, security controls, and common attack vectors.
• Excellent analytical and problem‑solving skills, with keen attention to detail.
• Strong communication and interpersonal skills, with the ability to collaborate with cross‑functional teams.
• Must be a U.S. citizen.

• Relevant certifications (Security+, CySA+, CEH, GSEC, or similar).
• Experience with automation or scripting (Python, Power Shell, Bash).
• Background in secure configuration management, container security, or Dev Sec Ops  tooling.
• Knowledge of SIEM or threat detection platforms.

At Sherpa 6 we love to solve problems and provide the best solutions for our customers. Our approach is user‑focused and design‑driven, seeking simple yet functional solutions. We are a group of enthusiastic forward‑thinkers committed to building amazing solutions with bleeding‑edge technology. Sherpa 6 is a Service‑Disabled Veteran Owned Small Business dedicated to protecting and giving our war fighters the edge they need.

• Medical coverage for you and your family.
• Dental, vision, health and wellness benefits.
• Generous retirement savings plan.
• Generous PTO policy.

Salary Range: $70,000–$105,000 per year. Negotiation will consider location, experience, skills, education and certifications.

Sherpa 6 will make reasonable accommodations in compliance with the Americans with Disabilities Act 1990. Sherpa 6 does not discriminate based on race, color, national origin, sex, religion, age, disability, sexual orientation, gender identity, veteran status, height, weight, or marital status and is an equal access/opportunity/affirmative action employer.