Security and Vulnerability Management Engineer

Peraton; Washington (District of Columbia); On-site; USD 112,000 - 179,000; Full time

Job summary

Peraton is seeking a Security and Vulnerability Management Engineer in Washington, DC, to lead vulnerability assessments, patching, and security governance across on-prem, cloud, and VDI environments. You will implement risk-based remediation plans, coordinate with system owners, and drive metrics for executive reporting.

The role requires hands-on expertise with Nessus, SIEM integrations, and patch management tools, plus the ability to obtain a Tier 2 Public Trust clearance.

Qualifications

• Experience delivering enterprise-scale cybersecurity projects across vulnerability assessment and remediation.
• Strong knowledge of NIST SP 800-53 Rev. 5 and RMF.
• Hands-on patching across Windows, Linux, and SQL Server, with cloud posture review.
• Ability to obtain and maintain Tier 2 Public Trust clearance.
• On-site in Washington, DC with occasional after-hours and travel.

Responsibilities

• Conduct authenticated and unauthenticated vulnerability assessments across servers, endpoints, network devices, SQL Server, VDI, and cloud workloads; provide validated findings with reproducible steps.
• Build a risk-based prioritization matrix using CVSS, asset criticality, and real-world exploitability; maintain asset inventory and scan coverage records.
• Optimize Nessus scanning: tune policies, resolve credentialed-scan failures, refine scheduling, close coverage gaps across on-prem, cloud, and VDI.
• Correlate findings with Microsoft Sentinel and Varonis (and Splunk secondarily) to validate results and suppress false positives.
• Stand up and run remediation governance: ownership model, SLA targets, closure standards, escalation workflows; initial Plan due within 60 days.
• Drive backlog reduction: analyze root causes, build remediation plans, and track burn-down to closure.
• Coordinate remediation with system owners; validate fixes and document retest outcomes.
• Perform root-cause analysis on recurring vulnerabilities; implement corrective and preventive actions with owners and dates.
• Build dashboards and metrics for technical and executive audiences (MTTR, aging, backlog burn-down, patch compliance).
• Design and improve patch deployment rings, maintenance windows, and automation with SCCM, Ivanti, Jamf; produce compliance metrics.
• Develop risk-based Windows/Linux server patching plans and change requests; validate results and document rollback procedures.
• Support business continuity and disaster recovery documentation related to patching and critical systems.
• Review Check Point configurations for misconfigurations; implement hardened configurations with change management; document validation.
• Review and tune Defender policies for Windows and macOS against NIST; pilot tests before enterprise rollout.
• Network-layer analysis across firewall rules, DNS dependencies, routing, and cloud configs; review VPN/proxy/IPS-IDS; troubleshoot access paths.
• Conduct cloud security posture reviews (AWS, Azure) including segmentation and ZTNA gateway review.
• Review Entra ID and AD architecture; enhance Conditional Access, PIM, and MFA coverage.
• Support penetration testing and red team exercises; produce Security Assessment Reports with scope, findings, evidence, and retest results.
• Author runbooks, SOPs, secure configuration references, change docs; technical writing is required.
• Deliver weekly status reports; monthly vulnerability/patching/assessment reports; critical vulnerability notifications within customer-specified timelines.
• Occasional after-hours work for patching windows, assessments, policy changes, and incident response.
• Travel periodically to alternate computing facilities in DC metro area as directed.

Skills

Vulnerability assessments

Security governance

SIEM analysis

Policy & change management

Education

Bachelor's degree or higher in IT, Cybersecurity, or related field

Tools

Nessus

Burp Suite

Nmap

Kali Linux

Microsoft Configuration Manager

Ivanti

Jamf

Microsoft Defender

Job description

Responsibilities

Security and Vulnerability Management Engineer

• Location: Washington, DC - on site Monday, Tuesday, and Wednesday, with up to two remote days per week
• Suitability: Must be able to obtain and maintain a Tier 2 Public Trust security clearance
• Travel: Periodic local travel to an alternate computing facility in the DC metro area
• Engagement for this assigned work: Full-time position, approximately 9 months (November 2026 – July 2027).

Responsibilities

• Conduct authenticated and unauthenticated vulnerability assessments across servers, endpoints, network devices, Microsoft SQL Server instances, VDI, and AWS and Azure cloud workloads, delivering validated findings with reproducible steps and supporting evidence.
• Build and maintain a risk-based prioritization matrix using CVSS severity, asset criticality, and real-world exploitability mapping, with supporting asset inventory and scan coverage records.
• Optimize the Nessus scanning program: tune scan policies, resolve credentialed-scan failures, refine scheduling, and close coverage gaps across on-premises, cloud, and VDI environments.
• Correlate findings against Microsoft Sentinel and Varonis, with Splunk secondarily, to validate results and systematically suppress false positives.
• Stand up and run the remediation governance framework: ownership and accountability model, risk-based prioritization, SLA targets, closure standards, and escalation workflows. An initial Governance and Process Improvement Plan is due within 60 days of start.
• Drive the vulnerability backlog reduction initiative: analyze root causes of deferred findings, build targeted remediation plans, and track burn-down to closure.
• Coordinate remediation with system owners, validate and retest fixes, and document retest outcomes.
• Perform structured root cause analysis on recurring vulnerability patterns and implement corrective and preventive process and tooling improvements with named owners and target dates.
• Build dashboards and metrics for technical and executive audiences, including MTTR, aging, backlog burn-down, patch compliance percentage, and exception tracking.
• Design and improve endpoint patch deployment rings, maintenance windows, and automation using Microsoft Configuration Manager, Ivanti, and Jamf, and produce compliance metrics.
• Develop risk-based Windows and Linux server patching plans and workflows, submit and track formal change requests, validate results, and document rollback procedures.
• Support critical service continuity, including updates to business continuity and disaster recovery documentation as it relates to patching and critical systems.
• Review Check Point configurations to identify misconfigurations, overly permissive rules, and deprecated policy objects; implement hardened configurations through approved change management and produce validation documentation.
• Review and tune Microsoft Defender policies for Windows and macOS against NIST SP 800-53 Rev. 5, including Jamf-managed macOS device compliance, with pilot testing before enterprise rollout.
• Perform network-layer analysis across firewall rule sets, ACLs, NAT, DNS dependency chains, routing logic, and segmentation; review VPN, proxy filtering, and IPS/IDS configurations; troubleshoot identity and access paths.
• Conduct AWS and Azure cloud and network security posture reviews, including network segmentation and ZTNA gateway review.
• Review Entra ID and Active Directory Domain Services architecture, enhance Conditional Access policies, and assess PIM and MFA enforcement coverage and gaps.
• Support penetration testing and red team exercises, and produce formal Security Assessment Reports containing scope, findings, evidence, impact, recommendations, proof-of-concept reproduction steps, and retest results.
• Author runbooks, playbooks, SOPs, secure configuration references, change implementation documentation, and knowledge transfer documentation. Technical writing is a functional requirement of this role, not a secondary skill.
• Deliver weekly status reports covering tasks, blockers, risks, and after-hours work; monthly vulnerability management, endpoint patch compliance, and server patching and change request reports; security assessment reports following each assessment; and critical vulnerability notifications within the timeframe specified by the Customer.
• Perform after-hours work as needed for patching windows, assessments, policy changes, incident response, and critical vulnerability response.
• Travel periodically to the Customer's alternate computing facility in the DC metro area as directed. Local travel is not separately reimbursed.

Qualifications

Basic Qualifications

• Bachelor's degree and 8 years of relevant experience, master's degree and 6 years, or 12 years of experience in lieu of a degree.
  • Minimum of 5 years of hands-on experience is required regardless of degree path.
• 5+ years of hands-on experience delivering enterprise-scale cybersecurity projects spanning vulnerability assessment, remediation planning, endpoint security, system hardening, and penetration testing.
• Demonstrated authenticated and unauthenticated vulnerability assessments producing validated, evidence-based findings.
• Strong working knowledge of NIST SP 800-53 Rev. 5, NIST RMF, defense-in-depth, Zero Trust, and IRS Publication 1075.
• Hands-on remediation and patching across Windows Server, Linux, and Microsoft SQL Server; AWS and Azure administration sufficient to perform cloud posture review.
• Check Point firewall and endpoint policy administration.
• Microsoft Defender policy administration for both Windows and MacOS.
• Proficiency with Nessus, Burp Suite, Nmap, and Kali Linux or equivalents.
• Network analysis across segmentation, firewall rules, DNS dependencies, routing logic, and cloud network configurations.
• IAM security experience including Conditional Access, PIM, and MFA enforcement.
• SIEM correlation using Microsoft Sentinel, Varonis, or equivalent.
• Scripting in Python, PowerShell, or C#.
• Patch tooling experience with Microsoft Configuration Manager, Ivanti, or Jamf.
• Enterprise virtualization and VDI experience.
• Formal change management experience building, submitting, and tracking change requests with validation and rollback planning.
• Ability to independently plan, execute, document, and validate technical deliverables to acceptance, with reproducible steps and retest results, without significant rework cycles.
• Ability to obtain and maintain Tier 2 Public Trust, including credit check, FBI criminal history check, and in-person fingerprinting at a designated federal facility in Washington, DC. Typical processing is 60 to 120 days.
• Willingness to complete IRS Publication 1075 Federal Tax Information training prior to system access if assigned to FTI-connected systems.
• Ability to work on site in Washington, DC Monday through Wednesday and support after-hours activity.
• Immediate availability; anticipated start on or about November 1, 2026.
• U.S. citizenship required.
• Must be able to obtain and maintain a Tier 2 Public Trust clearance.

Preferred Qualifications

• Bachelor's degree in IT, Computer Science, Cybersecurity, or a related field.
• CISSP, CISM, GIAC, OSCP, CEH, Security+, AWS Certified Security – Specialty, or Microsoft security certifications such as AZ-500 Security Engineer Associate. All certifications are preferred; none are mandatory for this position.
• SOC operations, incident response, or red team experience.
• Social engineering and physical security testing experience.
• Vulnerability management metrics, dashboards, and executive risk reporting.
• Automation scripting, playbook development, and workflow integration.
• Zero Trust network architecture, NAC/ISE review, and IPS/IDS tuning.
• Remediation runbooks, secure configuration baselines, and hardening standards.
• Prior federal agency or IRS Publication 1075 environment experience.
• Located in the Washington, DC metropolitan area.

Peraton Overview

Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world’s leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees do the can't be done by solving the most daunting challenges facing our customers. Visit peraton.com to learn how we’re keeping people around the world safe and secure.

Target Salary Range

$112,000 - $179,000.

This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual’s experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.

EEO

EEO: Equal opportunity employer, including disability and protected veterans, or other characteristics protected by law.