Cybersecurity Vulnerability Management Lead
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Cybersecurity Vulnerability Management Lead modernizing the NSF Cybersecurity Program for Cherokee Federal. Leading exposure management, prioritization, automation, and enterprise risk reduction.
Responsibilities:
- Lead and mature NSF's Vulnerability Management capability across enterprise, cloud, containerized, application, and hybrid environments
- Provide technical leadership to a team of vulnerability analysts
- Develop and maintain a Vulnerability Management roadmap aligned with evolving threats and organizational priorities
- Introduce and operationalize prioritization using CISA KEV, EPSS, threat intelligence, asset criticality, internet-facing asset identification, attack path analysis, and MITRE ATT&CK mapping
- Evaluate emerging technologies for vulnerability validation, attack surface visibility, and exposure management
- Own discovery, validation, prioritization, remediation coordination, exception handling, verification, and executive reporting
- Operate and optimize Tenable.sc, Tenable.io, and Nessus
- Improve scan coverage, credential management, accuracy, and false-positive reduction
- Integrate AWS Inspector, Security Hub, GuardDuty, Wiz, Prisma Cloud, and Microsoft Defender for Cloud findings
- Partner with Application Security and DevSecOps teams on AppScan, DAST, SAST, CI/CD integrations, and container image scanning
- Mature ServiceNow Vulnerability Response and CMDB integrations, including ticketing, SLA tracking, ownership, and escalation workflows
- Develop automation through APIs, Python, PowerShell, and orchestration capabilities
- Build executive dashboards and metrics covering MTTR, SLA adherence, vulnerability aging, exposure trends, scan coverage, and remediation effectiveness
- Brief cybersecurity leadership on emerging risks, remediation progress, and program maturity initiatives
Requirements:
- 8+ years of cybersecurity experience
- 4+ years of direct Vulnerability Management experience in a federal or large enterprise environment
- 3+ years leading vulnerability analysts, remediation programs, or enterprise VM initiatives
- Deep hands-on expertise with Tenable.sc, Tenable.io, and Nessus
- Experience implementing or significantly improving a Vulnerability Management or Exposure Management capability
- Experience with ServiceNow Vulnerability Response and CMDB integrations
- Experience leveraging CISA KEV, EPSS, threat intelligence, asset criticality, and attack path analysis
- Experience supporting AWS, Azure, or hybrid cloud environments
- Experience collaborating with Security Operations and Incident Response teams to identify and rapidly remediate actively exploited vulnerabilities
- Experience briefing technical teams, executives, and federal stakeholders
- Candidates must pass pre-employment qualifications of Cherokee Federal
- Preferred certifications include CISSP, GCIH, CySA+, Security+, Tenable Certified Professional, AWS Security Specialty, and ServiceNow Vulnerability Response Certification
- Highly desired experience includes SafeBreach, AttackIQ, Pentera, XM Cyber, Wiz, Prisma Cloud, AppScan, BAS, CCV, EASM, Kubernetes Security, and Detection Engineering
Benefits:
- Equal opportunity employer
- Pre-employment qualifications required
- Opportunity to support a strategic modernization effort within the NSF Cybersecurity Program
- Highly visible role with technical leadership responsibility
Similar Jobs
Senior Information Security Manager
Senior Information Security Manager leading security operations, incident response, and AI governance. Protecting 8am’s payments and workflow platform serving 250,000 U.S. professionals.
Information Security Engineer
Information Security Engineer securing 8am’s cloud, detection, and compliance systems. Protecting fintech software used by over 250,000 U.S. professionals.
Senior Director, Information Security and Compliance
Senior security leader advancing Foundant’s SaaS information security and GRC programs. Protecting mission-critical software serving foundations, nonprofits, and community organizations worldwide.
Security Engineer – GRC
Security Engineer owning governance, risk, and compliance for Alan’s health insurance and prevention platform. Managing ISO 27001, DORA, HDS, audits, risk, and security automation.
Associate Security Architect
Associate Security Architect detecting and mitigating cyberattacks for Akamai's managed security customers. Protecting digital properties through Akamai's distributed cloud, edge, and security platform.
Cloud Security Engineer
Cloud Security Engineer securing Azure infrastructure, identities, and AI workloads for a global IT transformation leader. Driving remediation, policy-as-code guardrails, and Microsoft Defender for Cloud posture improvement.
Portuguese Speaking Cybersecurity Customer Expert
Cybersecurity customer experts supporting Portuguese-speaking clients with security software and incident inquiries. Mercier Consultancy Group provides recruitment and BPO services across Europe.
Senior Cybersecurity Financial Compliance SME
Senior cybersecurity compliance SME ensuring DoW and Army audit readiness for ASRC Federal’s Vantage system. Applying NIST controls, FIAR requirements, and financial management overlays.
Security Architect
Arquiteto de Segurança da Informação na Verity, consultoria de transformação e engenharia digital. Projetando controles, riscos e práticas DevSecOps para ambientes Cloud e on-premises.
Security System Analyst – Lenel, Milestone
Security Systems Analyst supporting Lenel OnGuard and Milestone physical security systems for Securitas UK. Owning incident resolution, troubleshooting faults, and coordinating third-party engineers.
Signalling Security Specialist
Telecom signalling security specialist auditing telecom networks with PTA and supporting PTM IDS deployments. Delivering customer reports, presentations, troubleshooting, and operational improvements.
Cybersecurity Engineer
Cybersecurity Engineer automating cybersecurity operations, scripting, and API integrations for The Home Depot. Troubleshooting incidents and strengthening threat defense and access management.
Transit Safety Security Specialist
Transit safety specialist leading U.S. infrastructure safety, security, and certification projects for AECOM. Developing risk analyses, PTASPs, compliance documentation, and client training.
Manager, Cyber Security
Cyber Security Manager leading incident response, detection engineering, and security operations. Protecting Ping Identity’s cloud identity platform and enterprise systems.
Senior Domain Consultant – AI Security
AI Security Domain Consultant securing enterprise AI agents, applications, data, and supply chains. Leading customer PoVs, executive demos, architectures, and Prisma AIRS roadmap feedback.
Senior Security Architect – AD/Entra ID
Senior Security Architect securing Microsoft Active Directory and Entra ID environments for GuidePoint Security’s cybersecurity clients. Designing IAM architecture, automating administration and resolving complex identity security issues.
Information Security Engineer
Information Security Engineer securing Keyfactor’s cryptographic trust infrastructure. Managing monitoring, vulnerability assessments, incident response, and ISO 27001/SOC 2 compliance.
Cybersecurity Governance Analyst
Cybersecurity governance analyst developing enterprise policies, vendor risk assessments, and compliance controls. Supporting Agero’s digital driver assistance services through audits, remediation, and security awareness.
Senior Software Engineer – Security, Distributed Systems
Senior software engineer building backend distributed systems for RapidFort’s cybersecurity and software supply chain platform. Developing secure, scalable services across Linux, containers, Kubernetes, and cloud environments.
Staff Security Engineer, Proactive Security
Staff Security Engineer leading proactive security services, infrastructure protection, and secure engineering paths at DoorDash. Building resilient products for the technology and logistics company’s delivery network.