Sr. Vulnerability Analyst

Company Description

• Integres, LLC is a Service-Disabled Veteran Owned Small Business (SDVOSB) which was established to provide high quality, insightful, agile information technology-based solutions to its customers. Integrity is a foundational element of everything we strive to do. We seek to develop solutions which respond to the evolving challenges that today’s organizations face using our own unique combination of industry best practices, and evolving techniques and technologies. We started Integres with the intent of building "a company with a soul". As such, we take a servant-leadership approach as the long-term strategy for our success. We are cultivating a corporate family culture which demands excellence and accountability while putting a premium on work/life balance. We empower and support our employees to contribute to achieving our corporate goals by interacting with our customers as true partners, rather than treating their engagement as just another job. We seek to be good corporate citizens and encourage and promote employee participation in community and volunteer work.

Job Description

• Daily oversight of vulnerability management program
• Serve as liaison between Security Assessment and Security Operation Center (SOC) functions on matters pertaining to vulnerability scanning for security assessment efforts
• Plan, execute, monitor and control, and successfully close vulnerability management projects/tasks
• Configure and schedule patch and secure configurations audit scan jobs (vulnerability scans)
• Maintain configurations of patch and secure configurations scan jobs i.e., asset lists, scan plugins, STIGs audit files, CIS Benchmarks audit files, scan credentials
• Troubleshoot and resolve failed patch and secure configurations scan jobs i.e., missing credentials, asset list updates, firewall issues
• Analyze patch and secure configurations audit scan results and identify and document technical and procedural vulnerability findings
• Research resolution strategies/measures for identified vulnerability findings and provide remediation/mitigation recommendations
• Identify false positive findings and determine and advise on the criteria for validating the findings i.e., required artifacts
• Prepare vulnerability management reports on the status of patch and secure configuration audit scans and associated remediation efforts
• Communicate status vulnerability management efforts to include regular scheduled reports and as well as ad hoc reports
• Ensure the vulnerability management platform maintains updated versions of secure configurations scans audit files i.e., proprietary vendor audit files, STIGs audit files, CIS Benchmarks audit files
• Ensure that vulnerability management services are operating as expected i.e., completeness of the of each scope scan jobs, timely completion of scan jobs, up-to-date patch audit plugins
• Ensure proper functioning of integrations between the vulnerability management platform and other tools such as asset management and risk management platforms
• Ensure and data updates from vulnerability management platforms to asset management and risk management platform are running as scheduled
• Maintain knowledge of applicable cyber defense policies, regulations, and compliance documents specifically related to cyber defense auditing.
• Development and implementation operational and technical vulnerability management policies
• Defining, developing, implementing, and processes and procedures for to support and maintain vulnerability management program

Qualifications

• At least five (12) years of experience with NIST Risk Management Framework (RMF) supporting technical assessment (vulnerability scans) of control implementations and continuous monitoring post-system Authority to Operate (ATO)
• At least ten (10) years of hands-on experience in LAN Administration i.e., Hands-on administration of Windows OS and Linux OS, and hands-on basics administration of routers, switches, and firewalls.
• At least five (5) years of hands-on experience with Tenable Security Center/ Nessus Scanners i.e., creating, maintaining, and running scan jobs and analyzing scan results
• At least five (5) years of hands-on experience planning, executing, monitoring and controlling, and closing security assessment projects
• Associates or bachelor’s degree from an accredited college or university with a major in Computer Science, Information Systems, Engineering or related scientific or technical discipline.
• Ability to work outside of regular business hours, the role may require on-call support after regular business hours or weekends.
• At least 1 security management industry certifications such as CISSP, CISM, CISA, CRISC etc.
• Self-starter, able to gather requirements, plan, execute syst