Senior Vulnerability Analyst (US)

VulnCheck Inc.; United States; Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Unlimited PTO

401k with company match

Healthcare coverage

Parental leave

Remote friendly environment

Cell Phone & Internet reimbursement

Professional development

Career advancement

Job summary

VulnCheck, The Exploit Intelligence Company, seeks a Senior Vulnerability Analyst to advance vulnerability research and threat intelligence. The role emphasizes CVE processes, CWE/CAPEC mappings, CVSS scoring, and collaboration with researchers and product security teams.

This 100% remote position prefers candidates in MA, MD, or Greater Austin TX, with a strong emphasis on data quality and process rigor. You will mentor teammates and contribute to playbooks enhancing triage and reporting

Qualifications

• Proven experience with the CVE Program—analyst, CNA, or significant contributor in a major org.
• Expert knowledge of MITRE ATT&CK, CAPEC, CWE, and mapping vulnerabilities to these frameworks.
• Advanced understanding of CVSS v3/v4 with real-world scoring and risk communication.

Responsibilities

• Map vulnerabilities to MITRE ATT&CK techniques and CAPEC patterns with precision.
• Assign CWE IDs with well-documented rationales.
• Calculate CVSS base scores with defensible justifications.
• Review, draft, and curate CVE Records per CVE Program standards.
• Collaborate with researchers, product security teams, and standards bodies.
• Develop and refine workflows for vulnerability triage, mapping, and reporting.
• Mentor junior analysts and drive knowledge-sharing initiatives.

Skills

CVE Process

MITRE ATT&CK

CAPEC

CWE

CVSS v3/4

Vulnerability Mapping

Data Quality

Communication Skills

Tools

Python

Golang

Job description

Senior Vulnerability Analyst

Location: MA / Austin TX / MD
Team: Research
Employment Type: Full-Time, Remote

About VulnCheck

Exploitation prevention is only as strong as the intelligence driving those efforts, and most of the industry is still running on intelligence that lacks exploit context. VulnCheck, The Exploit Intelligence Company, delivers structured exploit intelligence on what is actively weaponized in the wild, purpose-built for the data lakes, ETL pipelines, automation, and AI and LLM workflows your infrastructure already runs on, raising the capability of everything it powers.

About the Role

Are you passionate about advancing the science of vulnerability analysis and threat intelligence? Do you want to join a mission-driven team that delivers real-world impact—and has the resources and technical culture to fuel your curiosity?

We’re searching for a Senior Vulnerability Analyst with a deep understanding of the vulnerability management ecosystem, hands‑on experience with the CVE process, and expert knowledge in standard frameworks like MITRE ATT&CK, CAPEC, CWE, and CVSS. This is a rare opportunity to leverage your skills and experience as a contributor to, or expert user of, CVE and related MITRE capabilities—while taking your career in vulnerability research to the next level.

We are expanding our Threat Intelligence team and are looking for a detail‑oriented analyst to join VulnCheck. This is a 100% remote role with preference for candidates located in Massachusetts, Maryland, OR Greater Austin TX.

What You’ll Do

• Map vulnerabilities: Analyze and map discovered vulnerabilities to MITRE ATT&CK techniques and CAPEC attack patterns with precision and consistency.
• CWE assignment: Determine and assign accurate CWE (Common Weakness Enumeration) IDs, producing well‑documented rationales.
• CVSS calculation: Authoritatively calculate CVSS v3/v4 base scores, providing transparent, defensible justifications.
• CVE Processing: Review, draft, and curate CVE Records, ensuring data quality, fidelity, and consistency with CVE Program standards.
• Collaboration: Liaise with vulnerability researchers, product security teams, and standards communities to ensure best practices and knowledge transfer.
• Process improvement: Develop and refine workflows and playbooks for vulnerability triage, mapping, and reporting.
• Mentorship: Share your expertise by mentoring junior analysts and driving team knowledge‑sharing initiatives.

What You’ll Bring

• Proven experience with the CVE Program—either as an analyst, CNA, or significant contributor in a major software or security organization.
• Expert knowledge of MITRE ATT&CK, CAPEC, CWE, and working experience mapping vulnerabilities to these frameworks.
• Advanced understanding of CVSS (v3 and v4), including real‑world application to vulnerability scoring and risk communication.
• Strong analytical, technical, and research skills, with a passion for data quality and process rigor.
• Exceptional written and verbal communication skills—including the ability to translate complex technical details for diverse audiences.
• Experience engaging with community initiatives, standards bodies, or open‑source projects in the vulnerability or threat intelligence space is highly desirable.

Preferred Qualifications

• Experience contributing to the evolution of vulnerability standards (e.g., participation in CVE Editorial Boards, CAPEC Working Groups, or similar).
• Familiarity with automation tools or programming/scripting languages (Python, Golang, etc.) for data enrichment or workflow improvement.
• Published research, whitepapers, or presentations in the field of vulnerability analysis, mapping, or threat intelligence.

IMPORTANT NOTE: This position may involve access to technology subject to U.S. export control regulations. Employment is contingent upon the company’s ability to authorize access under applicable export control, sanctions, and any other applicable legal or contractual requirements. The company does not guarantee and is under no obligation to seek such authorization if it would be necessary.

What We Offer

We believe people do their best work when they feel supported, trusted, and valued. VulnCheck offers benefits designed to meet a wide range of needs and lifestyles:

Benefits and Perks

• Unlimited PTO
• 401k plan with company match
• Comprehensive healthcare coverage
• Generous paid parental leave
• Remote friendly environment with flexibility
• Expense reimbursement for Cell Phone & Internet
• Ongoing professional development, coaching, and learning resources
• Opportunities for career advancement within a fast‑growing team

Why Join Us

Built on over two decades of cybersecurity experience, our team of experts understands the intricacies of vulnerabilities, their exploitation in the wild, and how to leverage this data to build more effective cybersecurity products that produce better outcomes for organizations.

VulnCheck gives organizations a tactical advantage by providing best‑in‑class exploit & vulnerability intelligence information. We have a sense of duty to protect the critical infrastructure we rely on including medical devices, power grids and telecommunication networks. We were founded in 2021 in Lexington, Massachusetts.

VulnCheck has a transparent, collaborative, and supportive culture - we are looking for people who have a growth mindset, are curious and innovative. Our team is smart, but humble, hardworking, and supportive.

VulnCheck is proud to be an Equal Employer Opportunity employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics. VulnCheck is committed to working with and providing reasonable accommodations to applicants with physical and mental disabilities. *Even if your experience doesn’t perfectly align with the job description, we encourage you to apply—we value potential just as much as a perfect resume.