Enterprise Vulnerability Risk Lead

Booz Allen Hamilton; Washington (District of Columbia); On-site; USD 99,000 - 225,000; Full time

Job summary

Booz Allen Hamilton is seeking a Vulnerability Management Lead to modernize ACAS capabilities for DoD clients and design enterprise-wide STIG compliance solutions. You will act as a trusted advisor at the intersection of architecture, engineering, and client influence, driving hands-on outcomes in a complex security program.

The role requires coordinating with RMF teams, delivering risk-based remediation strategies, and producing executive-level briefings on cyber risk posture.

Qualifications

• 4+ years leading automation projects using Infrastructure as Code (IaC).
• 3+ years supporting DoD or IC cybersecurity programs.
• Experience with ACAS, including Tenable.sc or Nessus, in enterprise environments.
• Experience designing enterprise STIG compliance solutions.
• Knowledge of RMF, NIST 800-53, POA&M management, and continuous monitoring.
• Active TS/SCI clearance; willingness to take a polygraph exam.

Responsibilities

• Lead ACAS modernization, transitioning Tenable deployments to enterprise vulnerability management services.
• Standardize scan policies, credentialed coverage, asset tagging, and data hygiene.
• Design contractor-operated workflows for vulnerability intake, prioritization, remediation tracking, and risk acceptance.
• Integrate ACAS outputs into POA&M, ATO sustainment, and reporting requirements.
• Advise stakeholders on vulnerability prioritization, risk tradeoffs, and RMF integration.
• Partner with cyber engineering, RMF, and architecture teams to align vulnerability management with Zero Trust initiatives.
• Produce executive briefings on cyber risk posture and remediation effectiveness.
• Develop enterprise STIG frameworks enabling inheritance, reuse, and automation across systems.
• Standardize STIG baselines, tailoring, and documentation to reduce compliance burden.
• Implement and maintain SCAP/STIG tooling across server, endpoint, and platform tech.
• Produce defensible STIG artifacts and evidence for ATOs and continuous monitoring.
• Advise on remediation strategies and risk-based deviations.
• Automate repeatable tasks with scripting and workflow tooling.
• Integrate ACAS and STIG outputs with ticketing, GRC, or reporting systems.

Skills

IaC automation

DoD/IC cybersecurity experience

Vulnerability management

RMF/NIST 800-53 knowledge

Security clearance TS/SCI

Education

Associate's degree

Bachelor's degree

Master's degree

Tools

ACAS (Tenable.sc / Nessus)

SCAP/STIG tooling

GRC tooling (ServiceNow / Xacta / eMASS)

Python / PowerShell scripting

Job description

Booz Allen Hamilton is seeking a Vulnerability Management Lead to modernize ACAS capabilities for DoD clients and design enterprise-wide STIG compliance solutions. You will act as a trusted advisor at the intersection of architecture, engineering, and client influence, driving hands-on outcomes in a complex security program.

The role requires coordinating with RMF teams, delivering risk-based remediation strategies, and producing executive-level briefings on cyber risk posture.