Cybersecurity Vulnerability Scanning Analyst

Summit-Technologies,-Inc.; Chambersburg (Franklin County); Hybrid; USD 85,000 - 120,000; Full time

Job summary

Summit Technologies, Inc. is seeking a Cybersecurity Vulnerability Scanning Analyst to support DoD vulnerability identification for whitelisted websites and public-facing assets.

The role is hybrid, requiring residence within 60 miles of Chambersburg, PA with periodic on-site work. The analyst will operate security scanners, create and deliver vulnerability reports, and coordinate mitigations for DoD systems requiring a Secret clearance.

Qualifications

• 4+ years cybersecurity experience.
• Experience with BURP Suite Enterprise Edition.
• Experience configuring web browsers (Chrome/Firefox).
• Experience injecting payloads to trigger vulnerabilities (SQLi, XSS, etc.).
• Ability to review, document, and develop mitigation from scan results.

Responsibilities

• Operate, maintain, and administer security scanners for NIPRNet/SIPRNet workloads.
• Schedule, manage, and execute vulnerability scans.
• Monitor, report, and resolve scan issues and false positives.
• Ensure scans and configurations follow best practices and access policies.
• Analyze requirements to improve scan results and trends.
• Test and evaluate scanning tools and configurations.
• Maintain contact data and URLs in SharePoint/Data site.
• Deliver vulnerability reports with findings, mitigations, and trend data within 2 weeks.
• Assist clients during report reviews and asset scanning scope.
• Coordinate with service desks for vulnerability-related issues.

Skills

Cybersecurity experience

BURP Suite

Web browser configuration

Vulnerability payloads

Mitigation planning

STIGs knowledge

MS Office & SharePoint

Govt cybersecurity policies

Excellent communication

Education

Bachelor’s degree in IT/Cybersecurity/CS

CEH certification

Job description

Summit Technologies, Inc. has an opportunity for a Cybersecurity Vulnerability Scanning Analyst to maintain compliance with DoD vulnerability identification requirements for whitelisted websites and public-facing web presence. You will work as a team member to enhance the security posture of the DoD DMZ whitelisted websites, by conducting Web Vulnerability Scans (WVS) to identify and document gaps; and mitigate vulnerability. This hybrid position requires you to reside within 60 miles of Chambersburg, PA and be on site periodically. You must be a US citizen, as this is part of a government contract that requires a Secret security clearance.

Duties and Responsibilities

• Operate, maintain, and administer approved security scanners to plan, create, manage, and retire scheduled or ad hoc scan and scan groups for workloads across NIPRNet and SIPRNet.
• Develop, distribute, and manage execution against the schedule of vulnerability scans.
• Monitor, identify, report, and facilitate the resolution of scan performance impacting issues.
• Maintain and ensure scans, accounts, and configurations are set in accordance with best practice guides and privileged access policies and procedures.
• Analyze mission requirements and organizational feedback to create, maintain, and improve scan results.
• Test and evaluate scanning tools and configurations.
• Maintain client point of contact information, Internet Protocol (IP) ranges, and website/Universal Resource Locator (URL) information on the Data site via SharePoint.
• Create and deliver a Collective Trend Analysis Report and trend analysis including resolution data aimed at influencing the development of security strategies.
• Schedule, coordinate and perform vulnerability scans.
• Determine Ports/Protocols and Services Management (PPSM) compliance; provide mitigations, strategies, and false positive determinations.
• Create and deliver vulnerability scan reports, no later than two weeks after the scan is complete. Reports must include identified vulnerabilities, recommended resolutions/ mitigations, and trend analysis.
• When initiated by the client, assist with a review of the report (i.e., answer questions, identify what was scanned, assist if assets were skipped).
• Communicate and validate scan results in accordance with policies and procedures.
• Help with vulnerability scan related issues/problem resolution with applicable Service desks.

Required Experience and Skills

• Minimum 4 years of Cybersecurity experience.
• Experience utilizing BURP Suite (Enterprise Edition).
• Experience configuring web browsers (e.g. Chrome, Firefox, etc.).
• Experience injecting payloads to trigger vulnerabilities (e.g. SQL injection; XSS, Command Injection, Path Traversal, CSRF, IDOR).
• Skilled at reviewing, interpreting, documenting, and developing mitigation strategy from the scan results.
• Experience with STIGs and by-product analysis.
• Proficiency in MS Office Suite products and SharePoint collaborative tools.
• Working knowledge of government cybersecurity policies and procedures.
• Strong interpersonal and communication skills (oral and written).

Education

• A Bachelor’s degree in fields such as Information Technology, Cybersecurity, or Computer Science; Or CEH certification.

Certification

• 8570 IAT Level II (CCNA Security, CySA+, GICSP, GSEC, Security+ CE, CNS, SSCP).

Security Clearance

• DoD Secret security clearance

Summit Technologies Inc. appreciates your interest. We will contact the best matching prospects and will consider you for future opportunities. We will not submit your resume without your prior knowledge and consent. We are an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, sexual orientation, gender identity, national origin, disability or veteran status.