Remote Data Forensics & Vulnerability Management Analyst

cFocus Software Incorporated; Washington (District of Columbia); On-site; USD 130,000 - 170,000; Full time

Job summary

cFocus Software seeks a Vulnerability Management Analyst to join our program supporting the United States International Defense Finance Agency (DFC). This is a remote role requiring an Active Public Trust clearance.

The analyst will coordinate authenticated scans, analyze results from multiple platforms, validate findings, and drive remediation with cross-functional teams while ensuring compliance with federal standards and deadlines.

Qualifications

• Active Public Trust clearance is required to perform duties.
• Bachelor's degree in CS, IT, or related field is required.
• 5+ years in cybersecurity with 3+ years in vulnerability management or related functions.
• Hands-on experience with authenticated scans and vulnerability validation using enterprise platforms.
• Ability to assess vulnerability risk using CVSS, asset criticality, exposure, and mission impact.
• Experience maintaining POA&Ms, tracking remediation milestones, and documenting false positives.
• Knowledge of FISMA, NIST RMF/SP 800-53, and CISA KEV/BOD 22-01 requirements.
• Ability to clearly communicate technical risk to federal stakeholders.
• Strong writing, data quality, documentation, and time-management skills.
• Security certifications such as Security+, CySA+, CEH, CISSP preferred.

Responsibilities

• Coordinate authenticated vulnerability scans with DFC stakeholders per policy and system criticality.
• Analyze output from Tenable, Qualys, Microsoft Defender, and related platforms.
• Validate scanner findings with evidence and distinguish true issues from false positives.
• Assess severities using CVSS, policy, exploitability, and mission impact.
• Recommend risk-informed remediation priorities and timelines.
• Coordinate remediation ownership across engineering, operations, and cloud teams.
• Provide rapid analysis for KEV, BOD 22-01, and other directives; notify ISSM as required.
• Document affected systems, severities, exposure, and remediation evidence in CSAM/ServiceNow.
• Create POA&Ms in CSAM within 3 business days after findings or government direction.
• Maintain traceability between CSAM POA&Ms and ServiceNow tickets; ensure data quality.
• Track remediation to closure and provide written status updates on compliance and risk.
• Prepare risk acceptance packages when remediation cannot meet deadlines.
• Preserve federal authority in decision-making and do not authorize unapproved risk.

Skills

Active Public Trust clearance

Communication of risk to leadership

Analytical writing

Deadline-driven prioritization

Education

B.S. Computer Science, Information Technology, or a related field

Tools

Tenable Nessus

Qualys

Microsoft Defender

Job description

cFocus Software seeks a Vulnerability Management Analyst to join our program supporting the United States International Defense Finance Agency (DFC). This is a remote role requiring an Active Public Trust clearance.

The analyst will coordinate authenticated scans, analyze results from multiple platforms, validate findings, and drive remediation with cross-functional teams while ensuring compliance with federal standards and deadlines.