External Job Posting Title Security and Vulnerability Management Engineer

Peraton; Washington; Hybrid; USD 140,000 - 190,000; Full time

Job summary

Peraton seeks a Security and Vulnerability Management Engineer in Washington, DC for a ~9‑month contract. Role requires on‑site work Monday through Wednesday with up to two remote days per week, and eligibility for Tier 2 Public Trust clearance.

You will drive vulnerability assessments, remediation governance, and security posture improvements across on‑premises, cloud, and VDI environments. Responsibilities include building risk-based prioritization, tuning Nessus and patching programs,

Qualifications

• Bachelor's degree required with 8+ years of related experience
• Hands-on vulnerability assessments delivering validated findings with evidence

Responsibilities

• Conduct authenticated and unauthenticated vulnerability assessments across servers, endpoints, network devices, databases, VDI, and cloud workloads
• Build a risk-based prioritization matrix using CVSS, asset criticality, and real-world exploitability
• Tune Nessus scanning program and close coverage gaps across on-prem, cloud, and VDI environments
• Correlate findings with Microsoft Sentinel and Varonis; suppress false positives
• Lead remediation governance with ownership models, SLAs, and change workflows
• Drive backlog reduction with root-cause analysis and targeted remediation plans
• Coordinate remediation with system owners and document retest outcomes
• Develop dashboards for MTTR, aging, backlog burn-down, and patch compliance
• Design endpoint patch deployment rings and automation using SCCM, Ivanti, and Jamf
• Create risk-based patching plans for Windows and Linux servers; document rollback procedures
• Support business continuity and disaster recovery documentation related to patching
• Review Check Point configurations and implement hardened policies
• Tune Defender policies for Windows and macOS against NIST 800-53 Rev.5; pilot before enterprise rollout
• Perform network analysis of firewall rules, DNS, routing, and cloud network configurations
• Review cloud security posture in AWS/Azure and network segmentation
• Assess Entra ID/AD architecture; enhance Conditional Access and MFA coverage
• Support penetration testing and red team exercises; produce Security Assessment Reports
• Author runbooks, SOPs, and change documentation; enable knowledge transfer
• Deliver weekly and monthly security reports and critical vulnerability notifications

Skills

Vulnerability management

Risk-based prioritization

Nessus

Microsoft Defender

Check Point

SIEM (Microsoft Sentinel)

IAM (Conditional Access, PIM, MFA)

Scripting (Python/PowerShell)

Change management

Windows/Linux patching

Education

Bachelor's degree in CS/IS or related field

Tools

Nessus

Burp Suite

Nmap

Kali Linux

Microsoft Configuration Manager

Ivanti

Jamf

Splunk

Microsoft Sentinel

Varonis

Job description

Responsibilities

Security and Vulnerability Management Engineer

• Location: Washington, DC - on site Monday, Tuesday, and Wednesday, with up to two remote days per week
• Suitability: Must be able to obtain and maintain a Tier 2 Public Trust security clearance
• Travel: Periodic local travel to an alternate computing facility in the DC metro area
• Engagement for this assigned work: Full-time position, approximately 9 months (November 2026 - July 2027).

Responsibilities

• Conduct authenticated and unauthenticated vulnerability assessments across servers, endpoints, network devices, Microsoft SQL Server instances, VDI, and AWS and Azure cloud workloads, delivering validated findings with reproducible steps and supporting evidence.
• Build and maintain a risk-based prioritization matrix using CVSS severity, asset criticality, and real-world exploitability mapping, with supporting asset inventory and scan coverage records.
• Optimize the Nessus scanning program: tune scan policies, resolve credentialed-scan failures, refine scheduling, and close coverage gaps across on-premises, cloud, and VDI environments.
• Correlate findings against Microsoft Sentinel and Varonis, with Splunk secondarily, to validate results and systematically suppress false positives.
• Stand up and run the remediation governance framework: ownership and accountability model, risk-based prioritization, SLA targets, closure standards, and escalation workflows. An initial Governance and Process Improvement Plan is due within 60 days of start.
• Drive the vulnerability backlog reduction initiative: analyze root causes of deferred findings, build targeted remediation plans, and track burn-down to closure.
• Coordinate remediation with system owners, validate and retest fixes, and document retest outcomes.
• Perform structured root cause analysis on recurring vulnerability patterns and implement corrective and preventive process and tooling improvements with named owners and target dates.
• Build dashboards and metrics for technical and executive audiences, including MTTR, aging, backlog burn-down, patch compliance percentage, and exception tracking.
• Design and improve endpoint patch deployment rings, maintenance windows, and automation using Microsoft Configuration Manager, Ivanti, and Jamf, and produce compliance metrics.
• Develop risk-based Windows and Linux server patching plans and workflows, submit and track formal change requests, validate results, and document rollback procedures.
• Support critical service continuity, including updates to business continuity and disaster recovery documentation as it relates to patching and critical systems.
• Review Check Point configurations to identify misconfigurations, overly permissive rules, and deprecated policy objects; implement hardened configurations through approved change management and produce validation documentation.
• Review and tune Microsoft Defender policies for Windows and macOS against NIST SP 800-53 Rev. 5, including Jamf-managed macOS device compliance, with pilot testing before enterprise rollout.
• Perform network-layer analysis across firewall rule sets, ACLs, NAT, DNS dependency chains, routing logic, and segmentation; review VPN, proxy filtering, and IPS/IDS configurations; troubleshoot identity and access paths.
• Conduct AWS and Azure cloud and network security posture reviews, including network segmentation and ZTNA gateway review.
• Review Entra ID and Active Directory Domain Services architecture, enhance Conditional Access policies, and assess PIM and MFA enforcement coverage and gaps.
• Support penetration testing and red team exercises, and produce formal Security Assessment Reports containing scope, findings, evidence, impact, recommendations, proof-of-concept reproduction steps, and retest results.
• Author runbooks, playbooks, SOPs, secure configuration references, change implementation documentation, and knowledge transfer documentation. Technical writing is a functional requirement of this role, not a secondary skill.
• Deliver weekly status reports covering tasks, blockers, risks, and after-hours work; monthly vulnerability management, endpoint patch compliance, and server patching and change request reports; security assessment reports following each assessment; and critical vulnerability notifications within the timeframe specified by the Customer.
• Perform after-hours work as needed for patching windows, assessments, policy changes, incident response, and critical vulnerability response.
• Travel periodically to the Customer's alternate computing facility in the DC metro area as directed. Local travel is not separately reimbursed.

Qualifications

Basic Qualifications

• Bachelor's degree and 8 years of relevant experience, master's degree and 6 years, or 12 years of experience in lieu of a degree.
  • Minimum of 5 years of hands-on experience is required regardless of degree path.
• 5+ years of hands-on experience delivering enterprise-scale cybersecurity projects spanning vulnerability assessment, remediation planning, endpoint security, system hardening, and penetration testing.
• Demonstrated authenticated and unauthenticated vulnerability assessments producing validated, evidence-based findings.
• Strong working knowledge of NIST SP 800-53 Rev. 5, NIST RMF, defense-in-depth, Zero Trust, and IRS Publication 1075.
• Hands-on remediation and patching across Windows Server, Linux, and Microsoft SQL Server; AWS and Azure administration sufficient to perform cloud posture review.
• Check Point firewall and endpoint policy administration.
• Microsoft Defender policy administration for both Windows and MacOS.
• Proficiency with Nessus, Burp Suite, Nmap, and Kali Linux or equivalents.
• Network analysis across segmentation, firewall rules, DNS dependencies, routing logic, and cloud network configurations.
• IAM security experience including Conditional Access, PIM, and MFA enforcement.
• SIEM correlation using Microsoft Sentinel, Varonis, or equivalent.
• Scripting in Python, PowerShell, or C#.
• Patch tooling experience with Microsoft Configuration Manager, Ivanti, or Jamf.
• Enterprise virtualization and VDI experience.
• Formal change management experience building, submitting, and tracking change requests with validation and rollback planning.
• Ability to independently plan, execute, document, and validate technical deliverables to acceptance, with reproducible steps and retest results, without significant rework cycles.
• Ability to obtain and maintain Tier 2 Public Trust, including credit check, FBI criminal history check, and in-person fingerprinting at a designated federal facility in Washington, DC. Typical processing is 60 to 120 days.
• Willingness to complete IRS Publication 1075 Federal Tax Information training prior to system access if assigned to FTI-connected systems.
• Ability to work on site in Washington, DC Monday through Wednesday and support after-hours activity.
• Immediate availability; anticipated start on or about November 1, 2026.
• U.S