Cybersecurity Vulnerability Management Analyst III

Summa Health

Cleveland (OH)

Hybrid

USD 75,000 - 113,000

Full time

11 hours ago

Be an early applicant

Get a reply from this employer

Your resume and cover letter, tailored to exactly what they’re hiring for.

Get past ATS filters

Benefits offered by this job

Medical, dental, vision

Retirement Savings Plan

Paid time off

Education Assistance

Daily Pay

Job summary

Summa Health is seeking a Cybersecurity Vulnerability Management Analyst to identify, prioritize, and drive remediation of vulnerabilities across the organization's IT, cloud, and medical device environments. You will collaborate with engineers, system owners, and clinical teams to accelerate fixes without disrupting care.

Experience in healthcare security, seven years in information security, and relevant certifications are required.

Qualifications

Formal Education: Bachelor's degree in Computer Science, Cybersecurity, IT, or Engineering.
7+ years information security and IT experience in a complex healthcare environment.
Certifications: CompTIA Security+, CySA+, CASP; GVAC/CISSP preferred.

Responsibilities

Perform enterprise vulnerability identification, assessment, prioritization, and remediation tracking across on-prem and cloud environments.
Operate vulnerability scanning platforms (e.g., Rapid7 InsightVM) and validate findings with risk-based prioritization.
Coordinate with Infrastructure, Application Owners, Clinical Engineering, and vendors to drive timely remediation within SLAs.
Produce vulnerability metrics, dashboards, and reports for governance and leadership.

Skills

Vulnerability management

CVSS/EPSS knowledge

Communication skills

Risk prioritization

Threat awareness

Education

Bachelor's degree in CS/Cybersecurity/Engineering

Tools

Rapid7 InsightVM

Tenable

Qualys

Job description

Remote Opportunity - Hybrid Preferred

Summa Health is strengthening how we protect the systems our patients and caregivers depend on, and we’re looking for someone who will find the weaknesses before anyone else does. If you’ve worked in vulnerability management, you know the scan results never end and that not every finding deserves the same urgency. We want the person who can tell the difference. You’ll need the judgment to prioritize risk in a clinical environment, where some systems can’t simply be patched and rebooted, and the communication skills to work with engineers, system owners, and clinical teams to get fixes done without disrupting care. We act with urgency, follow through, and own what we find.

Summa Health

Full-Time / Benefit Eligible

Remote Opportunity - Hybrid Preferred

Summary

Under direction of the Manager, Cybersecurity Operations, the Cybersecurity Vulnerability Management Analyst is responsible for performing the tasks that support enterprise vulnerability identification, assessment, prioritization, and remediation tracking across the organization's technology environment, including on-premises infrastructure, cloud workloads, medical/IoT devices, and third-party connected systems.

Operates and maintains the organization's vulnerability scanning and assessment platform(s) (e.g., Rapid7 InsightVM), executes scheduled and ad hoc scanning activity, validates and triages findings, and applies risk-based prioritization using industry-standard scoring methodologies (e.g., CVSS, EPSS) in conjunction with asset criticality and business/clinical impact.

Coordinates with Infrastructure, Application Owners, Clinical Engineering, and third-party vendors to drive timely remediation of identified vulnerabilities and missing patches within established Service Level Agreements (SLAs), and documents risk exceptions, compensating controls, and Plans of Action and Milestones (POA&Ms) for vulnerabilities that cannot be remediated on standard timelines.

Monitors emerging Common Vulnerabilities and Exposures (CVEs), vendor security advisories, and threat intelligence to identify organizational exposure ahead of active exploitation, and produces recurring vulnerability management metrics, dashboards, and reporting to support Cybersecurity Governance, Risk, and Compliance (GRC) oversight and leadership decision‑making.

Formal Education Required: Bachelor's Degree or equivalent in Computer Science, Cybersecurity, IT, or Engineering or equivalent combination of education and/or experience.
Experience & Training Required: Seven (7) years information security experience; Seven (7) years of IT related experience; Experience working in a complex healthcare environment.
Certifications required: CompTIA Security+ (or equivalent).
CompTIA CySA+ (or equivalent).
CompTIA CASP (or equivalent).
Certifications preferred: GIAC Vulnerability Assessor (GVFA) (or equivalent).
CISSP (or equivalent).
Other Skills, Competencies and Qualifications:
- Advanced knowledge of vulnerability scanning and assessment platforms (e.g., Rapid7 InsightVM, Tenable, Qualys) and scan configuration, credentialed/uncredentialed scanning, and agent-based assessment methods.
- Advanced knowledge of vulnerability scoring frameworks (CVSS v3/v4) and exploit‑probability models (e.g., EPSS), and their application to remediation prioritization.
- Advanced knowledge of common vulnerability classes (e.g., buffer overflow, injection, misconfiguration, unpatched/end‑of‑life software, insecure default configurations) and their exploitation paths.
- Advanced knowledge of enterprise patch management processes and tooling (e.g., WSUS, Microsoft Intune/SCCM, Ivanti) and coordination with Infrastructure/Endpoint teams on patch cycles.
- Advanced knowledge of computer networking concepts and protocols, and network security methodologies (e.g., segmentation, firewalls, IDS/IPS).
- Advanced knowledge of cloud infrastructure security posture management concepts as applied to vulnerability identification in IaaS/PaaS/SaaS environments.
- Intermediate knowledge of medical device and operational technology (OT/IoMT) security considerations, including compensating controls where patching is not feasible.
- Intermediate knowledge of server and client operating systems, and common hardening baselines (e.g., CIS Benchmarks).
- Advanced knowledge of cyber threats, threat actor TTPs, and how emerging CVEs and advisories translate into organizational risk.
- Basic knowledge of laws, regulations, policies, and ethics as they relate to cybersecurity and privacy, including HIPAA Security Rule implications of unremediated vulnerabilities.
- Advanced skill in triaging scan output, eliminating false positives, and validating exploitability of findings.
- Advanced skill in developing and tracking remediation plans, risk exceptions, and compensating controls in a GRC risk register.
- Advanced skill in producing vulnerability management reporting, dashboards, and KPI/metrics packages for technical and executive audiences.
- Basic skill in utilizing virtual collaborative workspaces and/or tools (e.g., SharePoint, Teams, ticketing/ITSM platforms).
- Ability to communicate complex technical findings, concepts, or ideas in a confident and well‑organized manner through verbal, written, and/or visual means.
- Ability to evaluate information for reliability, validity, and relevance, and to synthesize scan data, asset context, and threat intelligence into prioritized remediation guidance.
- Ability to function effectively in a dynamic, fast‑paced environment with competing remediation priorities across clinical and business systems.
- Ability to develop productive working relationships with a broad range of business, clinical, and operational professionals to drive remediation without unilateral authority over their systems.
- Ability to negotiate resolutions for conflicting security and business/clinical operational objectives, including patch-window and downtime constraints.
- Ability to exemplify Summa Health's core values.
- Ability to take direction and operate independently in highly ambiguous situations.
- Ability to effectively interact with populations of patients/customers with an understanding of their needs for self-respect and dignity.
Level of Physical Demands: Sedentary: Exerts up to ten pounds of force occasionally and/or a negligible amount of force frequently.
Minimal, may occasionally move computer equipment (desktop, laptop, monitor, printer, and peripherals) when necessary.

Summa Health System is recognized as one of the region’s top employers by a number of third party organizations, including NorthCoast 99. Exceptional candidates gravitate to Summa because of its culture, passion for delivering excellent service to our patients and families commitment to our philosophy of servant leadership, collegial working relationships at every level of the organization and competitive pay and benefits.

Equal Opportunity Employer/Veterans/Disabled

$54.76/hr - $82.14/hr

The salary range on this job posting/advertising is base salary exclusive of any bonuses or differentials. Many factors, such as years of relevant experience and geographical location are considered when determining the starting rate of pay. We believe in the importance of pay equity and consider internal equity of our current team members when determining offers. Please keep in mind that the range that is listed is the full base salary range. Hiring at the maximum of the range would not be typical.

Summa Health offers a competitive and comprehensive benefits program to include medical, dental, vision, life, paid time off as well as many other benefits.