Vulnerability and Remediation Analyst - USDS

About the Team

The Validation and Verification (VnV) team ensures the security and reliability of our product through a comprehensive, continuous security lifecycle: Prevent → Assure → Test → Fix → Prove.

The Security Operations Assurance (SOA) team is the vital link between identifying security flaws (Test) and demonstrating risk reduction (Prove). We own the Assure and Fix stages, focusing on the operational execution of security control validation and remediation.



Working closely with the Offensive Security Operations (OSO) team, the AppSec, Vulnerability Management, & Assurance (AVA) team, and Enterprise Incident Response (EIR), the SOA team's analysts are the dedicated specialists responsible for managing the remediation lifecycle for all security findings.



About the Role

The Vulnerability and Remediation Analyst is a hands-on technical role within the SOA team, serving as the primary driver of the "Fix" stage across the organization. This position is responsible for the full operational lifecycle of security findings, from ingestion and validation to assignment, tracking, and final closure verification.



You will act as the crucial liaison between the teams that find the issues (OSO, AVA, EIR) and the engineering teams responsible for fixing them. This role requires technical security knowledge, exceptional organizational skills, meticulous attention to detail, and persistence in driving accountability to ensure organizational security risk is efficiently reduced and proven closed.



Responsibilities:

- Remediation Lifecycle Management: Meticulously manage the end-to-end lifecycle of all assigned security findings, including vulnerabilities, incidents, OSO reports, and AVA audit findings.

- Finding Triage and Validation: Triage incoming security findings, validate their severity and scope, and ensure all necessary context is documented before assignment to remediation teams.

- Assignment and Tracking: Utilize the central remediation tracking system to assign findings to correct asset owners, set target remediation deadlines, and proactively track progress against Service Level Objectives (SLOs).

- Cross-Functional Communication: Act as the primary point of contact between remediation teams (Engineering, DevOps) and finding teams (OSO, AVA, EIR), facilitating communication and overcoming roadblocks to expedite closure.

- Reporting Input: Collect, clean, and organize remediation data to feed into the SOA team's central operational dashboard and authoritative executive risk reports.

- Verification of Closure: Work with asset owners to verify that fixes are implemented correctly and effectively, closing out tickets only when remediation is confirmed.

- Process Adherence: Ensure all remediation activities adhere to established SOA governance models and standard operating procedures (SOPs).