Security Vulnerability Analyst

Job Description

• Work with infrastructure, application, and cloud teams to assess and maintain the usability and efficacy of vulnerability reporting.
• Assist in prioritizing remediation efforts using frameworks such as CVSS, EPSS, and organizational risk criteria.
• Work with infrastructure, application, and cloud teams to coordinate vulnerability remediation and verify fixes.
• Advise on the feasibility of remediation efforts within established service-level agreements (SLAs).
• Monitor emerging vulnerabilities, zero-day threats, and vendor security advisories.
• Produce reports and dashboards that communicate vulnerability trends, risk metrics, and remediation status to technical teams and leadership.
• Assist with vulnerability exception reviews and risk acceptance documentation.
• Maintain vulnerability management processes, documentation, and standard operating procedures.
• Support compliance initiatives including PCI DSS, ISO 27001, SOC 2, NIST, HIPAA, or CIS Controls, as applicable.
• Participate in incident response by providing vulnerability analysis and remediation recommendations when needed.
• Recommend security reporting improvements that reduce recurring vulnerabilities and improve overall security posture.

Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or equivalent experience.
• 2–5+ years of experience in vulnerability management, cybersecurity, or information security.
• Experience with vulnerability management tools such as:Tenable NessusQualys VMDRRapid7 InsightVMMicrosoft Defender Vulnerability ManagementWiz.IOAxoniusPanaseer
• Understanding of:CVSS scoringCWECVEMITRE ATT&CK FrameworkOWASP Top 10Common operating systems (Windows, Linux, macOS)Cloud platforms (AWS, Azure, or GCP)
• Understanding of patch management cycles and how they tie to remediation SLAs.
• Ability to analyze technical data and communicate risk effectively to both technical and non-technical stakeholders.
• Strong analytical, documentation, and problem-solving skills.
• Experience working across security domains (vuln management, plus possibly identity, endpoint, or compliance metrics) is a plus.