Vulnerability Management Analyst

Overview

DecisionPoint seeks a Vulnerability Management Analyst to support enterprise cybersecurity operations across a federal and DoD-aligned mission environment. This role conducts vulnerability scanning, patch verification, security analysis, prioritization of findings, mitigation tracking, and updates to Plan of Action and Milestones (POA&Ms). The analyst will help ensure systems remain compliant with DoD and federal cybersecurity controls by continuously identifying, validating, and monitoring vulnerabilities across cloud and on-premise environments. 

The Vulnerability Management Analyst plays a key role in enhancing the security posture of mission systems by providing actionable insights, collaborating with engineering teams, and maintaining visibility into risk trends and remediation progress. 

This position is fully remote. 

Note: By applying to this position, you acknowledge and consent to having your resume included in an active competitive government contract bid. 

Duties & Responsibilities

The Vulnerability Management Analyst will: 

• Conduct ACAS vulnerability scans across enterprise systems, applications, and cloud workloads. 

• Validate vulnerability scan results, confirm patch levels, and verify remediation status across environments. 

• Analyze vulnerabilities for exploitability, potential impact, and relevance to mission systems. 

• Prioritize vulnerabilities based on severity, risk scoring, operational context, and DoD guidance. 

• Coordinate with engineering, system administration, and cloud teams on mitigation steps and remediation timelines. 

• Update, track, and maintain POA&Ms with accurate vulnerability details and milestone progress. 

• Provide vulnerability summaries, dashboards, and reporting to cybersecurity leadership and government stakeholders. 

• Support continuous monitoring activities and reporting cycles in accordance with DoD RMF requirements. 

• Validate STIG-related findings and support configuration compliance checks. 

• Maintain ACAS scanning schedules, asset coverage, and scan completeness across environments. 

• Contribute to incident response efforts when vulnerabilities are linked to active threats. 

• Document vulnerability processes, scanning standards, and remediation workflows. 

 

Qualifications

Clearance Requirement 

Must hold an active Top Secret clearance, supported by a Tier 5 background investigation. 

 

Education (Required) 

Bachelor’s degree in Cybersecurity, Information Technology, or a related field. 

 

Experience (Required) 

• Minimum 5 years of experience in vulnerability management, cybersecurity operations, or system security analysis. 

• Experience running ACAS/Nessus scans and validating vulnerability data. 

• Experience analyzing vulnerabilities, prioritizing risk, and coordinating remediation with technical teams. 

• Experience updating POA&Ms, tracking mitigation progress, and supporting RMF continuous monitoring. 

• Experience performing patch verification and configuration-compliance checks. 

 

Technical Knowledge (Required) 

• Proficiency with ACAS and Nessus scanning tools. 

• Knowledge of vulnerability scoring (CVSS), exploitability assessment, and prioritization frameworks. 

• Understanding of DoD RMF continuous monitoring requirements and POA&M processes. 

• Knowledge of STIGs, secure configuration baselines, and compliance validation. 

• Familiarity with SIEM platforms, log analysis, and threat context enumeration. 

Technical Knowledge (Preferred) 

• Experience with cloud security scanning tools, especially AWS-native or container security scanners. 

• Experience with automation or scripting (Python, PowerShell) for data extraction or report generation. 

• Familiarity with enterprise asset management and CMDB tools. 

 

Certifications 

Required: 

• Security+ 
• ACAS Certification
• CEH

 

Preferred:

• Additional DoD 8570/8140 cybersecurity certifications 

 

Skills 

• Strong analytical and investigative abilities for evaluating vulnerabilities and identifying true risk. 

• Excellent written and verbal commun