Senior Vulnerability Management Lead — DoD RMF & ACAS Modernization

Booz Allen Hamilton; Reston (VA); On-site; USD 99,000 - 225,000; Full time

Job summary

Booz Allen Hamilton is seeking a Vulnerability Management Lead to modernize ACAS capabilities for DoD clients and design enterprise STIG compliance solutions. You will drive automation, advise on RMF integration, and lead cross-functional teams to deliver repeatable cyber risk management and mission velocity.

The role requires TS/SCI clearance, strong IaC experience, and expertise with ACAS (Tenable.sc/Nessus). You will engage stakeholders and produce executive briefings on cyber risk posture.

Qualifications

• 4+ years of experience leading automation projects using Infrastructure as Code (IaC).
• 3+ years of experience supporting DoD or IC cybersecurity programs.
• Experience with ACAS, including Tenable.sc or Nessus, in enterprise environments.
• Experience designing enterprise STIG compliance solutions.
• Knowledge of RMF, NIST 800-53, POA&M management, and continuous monitoring.
• Active TS/SCI clearance; willingness to take a polygraph exam.
• Associate’s, Bachelor’s, or Master’s degree in related IT fields with years of relevant work experience.

Responsibilities

• Lead ACAS modernization efforts, transitioning Tenable deployments from basic scanning to enterprise vulnerability management services.
• Modernize ACAS implementation by standardizing scan policies, credentialed coverage, asset tagging, and data hygiene.
• Design contractor-operated workflows for vulnerability intake, prioritization, remediation tracking, and risk acceptance.
• Integrate ACAS outputs into customer POA&M processes, ATO sustainment activities, and reporting requirements.
• Advise government stakeholders on vulnerability prioritization, risk tradeoffs, and RMF integration.
• Partner with cyber engineering, architecture, and RMF teams to align vulnerability management with Zero Trust modernization initiatives.
• Produce executive-level briefings on cyber risk posture, trends, and remediation effectiveness.
• Develop enterprise STIG compliance frameworks that enable control inheritance, reuse, and automation across systems.
• Standardize STIG baselines, tailoring decisions, and documentation to reduce per-system compliance burden.
• Implement and maintain SCAP or STIG tooling such as SCC, OpenSCAP, and vendor solutions, across server, endpoint, and platform technologies.
• Produce defensible STIG artifacts and evidence packages to support ATOs and continuous monitoring.
• Advise system owners and ISSMs on remediation strategies and risk-based deviations.
• Automate repeatable tasks using scripting and workflow tooling, where feasible.
• Integrate ACAS and STIG outputs with customer ticketing, GRC, or reporting systems.

Skills

Tenable.sc/Nessus

ACAS

RMF/NIST 800-53

Automation (Python/PowerShell)

DoD/IC cybersecurity programs

POA&M/IF&I knowledge

Vulnerability management

Education

Associate’s degree

Bachelor’s degree

Master’s degree

Tools

SCAP/OpenSCAP

SCC tooling

ServiceNow

Xacta

eMASS

Job description

Booz Allen Hamilton is seeking a Vulnerability Management Lead to modernize ACAS capabilities for DoD clients and design enterprise STIG compliance solutions. You will drive automation, advise on RMF integration, and lead cross-functional teams to deliver repeatable cyber risk management and mission velocity.

The role requires TS/SCI clearance, strong IaC experience, and expertise with ACAS (Tenable.sc/Nessus). You will engage stakeholders and produce executive briefings on cyber risk posture.