Endpoint Security Analyst 5515

Tier4 Group; Washington (District of Columbia); On-site; USD 90,000 - 130,000; Full time

Job summary

Tier4 Group is seeking an Endpoint Cybersecurity Vulnerability Remediation Analyst to identify, analyze, prioritize, and remediate vulnerabilities across enterprise workstations and servers. You will bridge Cybersecurity and IT Operations to convert findings into measurable remediation results and ensure SLAs are met.

The role requires hands‑on troubleshooting, vulnerability management, Windows administration, patching, and automation skills, with ongoing collaboration across endpoint, server,

Qualifications

• 3–5 years of experience in cybersecurity, vulnerability management, or a related IT discipline.
• Hands‑on experience remediating vulnerabilities in enterprise environments.
• Experience with CrowdStrike Falcon or similar tools.

Responsibilities

• Review vulnerability reports and exposure data; prioritize remediation by CVSS, exploitation, asset criticality, business impact, and OLAs.
• Own remediation of identified vulnerabilities from discovery to closure; deploy patches for Windows, Linux, and MacOS; coordinate with IT and infrastructure teams.
• Maintain vulnerability backlog and ensure OLAs are met; develop automation to improve remediation at scale.

Skills

Vulnerability management

Endpoint management

Windows administration

PowerShell scripting

Troubleshooting

Automation mindset

Cross-team collaboration

Tools

CrowdStrike Falcon

Intune

Azure Update Manager

SCCM

PowerShell

Job description

The Endpoint Cybersecurity Vulnerability Remediation Analyst is responsible for identifying, analyzing, prioritizing, and remediating cybersecurity vulnerabilities across enterprise workstation and server environments.

This position serves as a key operational link between Cybersecurity and IT Operations, with a strong focus on converting vulnerability findings into measurable remediation results. The analyst will regularly review vulnerability and exposure data from CrowdStrike Falcon, validate findings, determine appropriate remediation actions, and work directly with endpoint, server, application, and infrastructure teams to ensure vulnerabilities are resolved within established Operational Level Agreements (OLAs).

This is a hands‑on, mid-level technical position requiring strong troubleshooting, vulnerability management, Windows administration, patching, and automation skills.

Key Responsibilities

Vulnerability Analysis & Prioritization

• Review vulnerability reports, dashboards, and exposure data generated through CrowdStrike Falcon and related cybersecurity tools.
• Analyze open vulnerabilities affecting enterprise Windows, Linux, and MacOS workstations and servers.
• Validate vulnerability findings to determine affected systems, software versions, available patches, configuration changes, and other remediation options.
• Prioritize remediation based on CVSS severity
• Prioritize remediation based on Active or known exploitation
• Prioritize remediation based on Asset criticality
• Prioritize remediation based on Business impact
• Prioritize remediation based on Age of the vulnerability
• Prioritize remediation based on Established organizational OLAs

• Identify vulnerabilities that require immediate escalation due to active exploitation or significant organizational risk.
• Distinguish between vulnerabilities requiring operating system patches, application updates, configuration changes, software removal, or compensating controls.

Vulnerability Remediation

• Take direct ownership of assigned vulnerabilities from identification through successful remediation.
• Deploy and coordinate security patches for Windows workstations and servers, Linux servers, and MacOS devices.
• Use Microsoft Intune, Azure Update Manager, SCCM, Patch My PC, PowerShell, and other enterprise management tools to deploy and automate remediation.
• Work with server administrators and infrastructure teams when remediation requires server patching, configuration changes, application upgrades, or maintenance windows.
• Troubleshoot failed patches and unsuccessful remediation attempts.
• Develop remediation solutions for vulnerabilities where traditional patching is not available.
• Remove or upgrade obsolete, unsupported, and vulnerable software when appropriate.
• Validate that remediation actions have successfully eliminated or mitigated the identified vulnerability.
• Ensure remediation activities minimize disruption to business operations.

OLA & Vulnerability Backlog Management

• Monitor vulnerability aging and ensure assigned vulnerabilities are remediated within established OLAs.
• Maintain visibility into vulnerabilities approaching or exceeding OLA thresholds.
• Proactively escalation vulnerabilities that are at risk of missing remediation targets.
• Investigate vulnerabilities that remain open after remediation attempts and determine the root cause.
• Assist with reducing the organization's existing vulnerability backlog.
• Identify recurring vulnerabilities and recommend systemic solutions rather than repeatedly addressing individual systems.
• Track remediation progress and provide accurate status information to Cybersecurity and IT leadership.
• Support exception and risk-acceptance processes when vulnerabilities cannot be remediated within established timeframes.
• Develop PowerShell scripts and other automation to improve vulnerability remediation at scale.
• Automate repetitive activities such as software detection, version validation, application removal, patch deployment, configuration changes, and remediation verification.
• Develop Intune remediation scripts and deployment packages where appropriate.
• Identify opportunities to move from manual remediation to automated and policy-driven remediation.
• Analyze recurring vulnerability trends and recommend improvements to endpoint and server configuration standards.
• Create reusable remediation procedures for commonly identified vulnerabilities.

Reporting & Metrics

Assist with tracking and reporting key vulnerability-management metrics, including:

• Critical and High vulnerabilities
• Vulnerabilities by workstation/server
• Vulnerabilities by application or technology
• Vulnerabilities within OLA
• Vulnerability backlog
• Average vulnerability age
• Mean Time to Remediate (MTTR)
• Remediation success rate
• Reopened or recurring vulnerabilities
• Vulnerability reduction trends

Provide technical explanations for vulnerabilities that remain unresolved and recommend corrective actions.

Documentation

• Maintain clear documentation of vulnerability remediation procedures.
• Document root causes and resolutions for complex or recurring vulnerabilities.
• Develop knowledge articles and technical procedures that can be reused by Service Desk, Infrastructure, and Cybersecurity teams.
• Maintain documentation for automated remediation scripts and deployment packages.
• Document exceptions, dependencies, remediation failures, and required follow-up activities.

Required Qualifications

• 3–5 years of experience in cybersecurity, vulnerability management, endpoint management, Windows administration, systems administration, or a related IT discipline.
• Hands‑on experience remediating vulnerabilities in enterprise environments.
• Experience working with vulnerability management or endpoint security platforms such as CrowdStrike Falcon.
• Strong knowledge of Windows 10/11 and Windows Server environments.
• Experience with Microsoft Intune or comparable endpoint management platforms.
• Experience deploying operating system and third‑party application patches.
• Working knowledge of Microsoft Entra ID and enterprise endpoint management.
• Understanding of:
  • CVE and CVSS
  • Vulnerability severity and risk prioritization
  • Patch management
  • Zero‑day and actively exploited vulnerabilities
  • Compensating controls
  • Risk acceptance and vulnerability exceptions
• Strong troubleshooting and root‑cause‑analysis skills.
• Ability to manage multiple remediation efforts while meeting established OLAs.

Preferred Qualifications

• Experience with CrowdStrike Falcon Exposure Management / Spotlight.
• Experience with Microsoft Intune Remediations.
• Experience automating software deployment and vulnerability remediation.
• Experience with enterprise server patching processes.
• Familiarity with vulnerability and security frameworks such as NIST, CIS Controls, and CISA Known Exploited Vulnerabilities (KEV).
• Experience working within an ITIL‑based IT Service Management environment.
• Experience integrating vulnerability remediation with an ITSM platform.
• Security certifications such as Security+, CySA+, SSCP, GSEC, or equivalent are preferred but not required.

The successful candidate should demonstrate:

• Ownership – Takes responsibility for vulnerabilities through verified closure rather than simply identifying or assigning issues.
• Technical Problem Solving – Can determine why a vulnerability exists and identify the most effective remediation.
• Automation Mindset – Looks for opportunities to remediate hundreds of systems rather than addressing devices individually.
• Risk Awareness – Understands that vulnerability severity alone does not determine business risk.
• Urgency – Recognizes when active exploitation or critical exposure requires accelerated remediation.
• Collaboration – Works effectively across Cybersecurity, Service Desk, Infrastructure, Endpoint Engineering, and application teams.
• Continuous Improvement – Identifies systemic improvements that prevent vulnerabilities from repeatedly returning.

Measures of Success

• Percentage of Critical and High vulnerabilities remediated within OLA
• Reduction in vulnerability backlog
• Reduction in vulnerabilities exceeding OLA
• Mean Time to Remediate (MTTR)
• First‑attempt remediation success rate
• Percentage of remediation activities automated
• Accuracy and completeness of remediation documentation

Primary Objective

Drive measurable reduction of cybersecurity risk by ensuring workstation and server vulnerabilities are prioritized, remediated, validated, and closed within established OLAs.