Mid-Level Vulnerability Management Analyst

System One; Bethesda (MD); Hybrid; USD 90,000 - 120,000; Full time

Benefits offered by this job

Health and welfare benefits

401(k) plan

Job summary

System One in Bethesda, MD is seeking a Mid-Level Vulnerability Management Analyst to perform vulnerability scanning, analysis, reporting, and remediation tracking across NIH/OD-managed systems.

You will coordinate with stakeholders, monitor CVE sources, and develop remediation recommendations while working primarily remote with occasional onsite meetings. This role requires a BS in a related field and 3–6 years of cybersecurity experience; certifications are a plus.

Qualifications

• Bachelor's degree in Cybersecurity, CS, IT, or related field.
• 3–6 years of cybersecurity experience with vulnerability management.
• Experience with enterprise vulnerability management platforms.
• Knowledge of CVEs, CVSS, KEVs, NIST guidance, and FISMA.
• Strong analytical and communication skills.

Responsibilities

• Perform scheduled and ad hoc credentialed vulnerability scans.
• Review and analyze vulnerability scan results.
• Identify critical and known exploited vulnerabilities.
• Monitor the CISA KEV Catalog and other approved sources.
• Notify technical contacts of vulnerabilities and configuration issues.
• Develop remediation recommendations.
• Track vulnerabilities through closure and validate remediation.
• Support High Value Asset assessments.
• Prepare recurring and ad hoc vulnerability reports.
• Maintain documentation and support process improvements.

Skills

Analytical skills

Communication skills

Vulnerability management

Education

Bachelor's degree in Cybersecurity, CS, IT, or related field

Tools

Vulnerability management platforms

Job description

Job Title: Mid-Level Vulnerability Management Analyst

Location: Bethesda, Maryland

Type: Direct Hire / Perm

Work Model: 99% remote with occasional onsite for meetings

Security Clearance: Public Trust

Position Summary

The Mid-Level Vulnerability Management Analyst performs vulnerability scanning, analysis, reporting, remediation tracking, and stakeholder coordination across NIH/OD-managed systems.

Key Responsibilities

• Perform scheduled and ad hoc credentialed vulnerability scans.
• Review and analyze vulnerability scan results.
• Identify critical and known exploited vulnerabilities.
• Monitor the CISA KEV Catalog and other approved sources.
• Notify technical contacts of vulnerabilities and configuration issues.
• Develop remediation recommendations.
• Track vulnerabilities through closure and validate remediation.
• Support High Value Asset assessments.
• Prepare recurring and ad hoc vulnerability reports.
• Maintain documentation and support process improvements.

Minimum Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field.
• 3–6 years of cybersecurity experience with vulnerability management.
• Experience with enterprise vulnerability management platforms.
• Knowledge of CVEs, CVSS, KEVs, NIST guidance, and FISMA.
• Strong analytical and communication skills.

Recommended Certifications

• CompTIA Security+
• CompTIA CySA+
• GIAC Certified Vulnerability Assessor (GCVA)
• ISC2 Certified in Cybersecurity (CC)
• Tenable Certified Professional
• Qualys VMDR Certification

System One, and its subsidiaries including Joulé and Mountain Ltd., are leaders in delivering outsourced services and workforce solutions across North America. We help clients get work done more efficiently and economically, without compromising quality. System One not only serves as a valued partner for our clients, but we offer eligible employees health and welfare benefits coverage options including medical, dental, vision, spending accounts, life insurance, voluntary plans, as well as participation in a 401(k) plan.

System One is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, age, national origin, disability, family care or medical leave status, genetic information, veteran status, marital status, or any other characteristic protected by applicable federal, state, or local law.