Vulnerability Management Analyst

TIME Systems; Camp Springs (MD); On-site; USD 90,000 - 130,000; Full time

Benefits offered by this job

Health coverage

Dental coverage

Vision coverage

Life insurance and AD&D

401(k)

HSA/FSAs

Job summary

TIME Systems is seeking a Vulnerability Management Analyst to join the Cybersecurity Operations team supporting AFNCR ITS. You will perform vulnerability assessments, review DISA STIGs, coordinate remediation, and assist RMF compliance across DoD environments.

Collaborate with cybersecurity engineers, ISSOs, and system administrators to improve security posture and ensure mission-critical systems stay protected. DoD clearance required.

Qualifications

• Bachelor’s degree in Cybersecurity or related technical field; equivalent education/experience allowed.
• Minimum 4 years in cybersecurity or systems administration with 1 year in vulnerability mgmt.
• Active DoD Secret clearance.
• Current CompTIA Security+ CE or higher with DoD 8570/8140 IAT Level II.
• Hands-on experience with Tenable/Nessus/ACAS.
• Knowledge of STIGs, SCAP, and secure configurations.
• Understanding RMF, NIST 800-53, POA&Ms, and Air Force policies.
• Experience drafting reports and remediation plans.
• Excellent written/verbal communication; able to work independently.

Responsibilities

• Perform vulnerability assessments across classified/unclassified environments using Tenable/Nessus/ACAS.
• Review scan results, prioritize remediation, and validate findings.
• Coordinate remediation with system admins, ISSOs, and engineers.
• Support POA&Ms tracking per RMF requirements.
• Validate DISA STIGs, SCAP results, and secure baselines.
• Generate reports, compliance metrics, and executive summaries.
• Maintain ACAS inventories and scan configurations.
• Assist with vulnerability trend analysis and risk scoring.
• Support audits, inspections, and C&A activities.
• Collaborate across cybersecurity, engineering, and operations teams.
• Maintain SOPs and vulnerability management processes.

Skills

Vulnerability assessment

RMF

NIST SP 800-53

ACAS/Nessus/Tenable

DISA STIGs

SCAP SCC

POA&Ms management

Education

Bachelor’s degree in Cybersecurity or related field

Tools

ACAS

Nessus

Tenable SecurityCenter

SCAP Compliance Checker

eMASS

Job description

Vulnerability Management Analyst

Location - Joint Base Andrews, MD
Clearance - Secret
Certifications - CompTIA Security+ or equivalent

About TIME Systems

At TIME Systems, we are at the forefront of Technology, Innovation, Management, and Engineering solutions. Our commitment to empowering our team and fostering impactful leadership has established us as a leader in our field. Our work extends beyond business, actively contributing to local charities. We are proud of our CMMI Level 3 for Services and Development, ISO 9001:2015 certification, and our regular presence on Inc. Magazine’s “Inc. 5000 List” and Syracuse University’s IVMF “Vet 100 List”.

Benefits

• Health Coverage: Select from three plans, including a 100% company-funded employee-only plan.
• Dental Coverage: Our dental plan offers extensive care with no annual maximum.
• Vision: Our vision plan covers regular eye exams and corrective eyewear.
• Life Insurance and AD&D and other customizable coverage options!
• 401(k) Retirement Plan
• Health Savings Account (HSA), Flexible Spending Account (FSA), Short- and Long-Term Disability Insurance, Employee Assistance Plan, and more!

Why Join Us

• Veteran Preference – Strong value placed on military veterans and their skills.
• Career Growth – Opportunities for professional development in a supportive environment.
• Innovative Culture – Be part of a team that pushes boundaries and makes tangible impacts.

Role Summary

TIME Systems is looking for a Vulnerability Management Analyst to join our Cybersecurity Operations team supporting the Air Force National Capital Region (AFNCR) Information Technology Services (ITS) program. The selected candidate will support enterprise vulnerability management operations by performing vulnerability assessments, reviewing DISA STIG compliance, coordinating remediation activities, and assisting with Risk Management Framework (RMF) compliance across Department of Defense environments. This role will work closely with cybersecurity engineers, ISSOs, system administrators, and engineering teams to improve the organization’s security posture while supporting mission-critical systems throughout the AFNCR enterprise.

Key Responsibilities

• Perform vulnerability assessments utilizing Tenable SecurityCenter, Nessus, and Assured Compliance Assessment Solution (ACAS) across classified and unclassified environments.
• Review vulnerability scan results to identify CAT I, CAT II, and CAT III vulnerabilities, validate findings, identify false positives, and prioritize remediation activities.
• Coordinate vulnerability remediation efforts with system administrators, ISSOs, engineering teams, and Queue Managers to ensure timely resolution of identified security findings.
• Support the development, maintenance, and tracking of Plans of Action and Milestones (POA&Ms) in accordance with Risk Management Framework (RMF) requirements.
• Validate and review DISA Security Technical Implementation Guides (STIGs), Security Content Automation Protocol (SCAP) results, and secure configuration baselines.
• Generate vulnerability assessment reports, compliance metrics, executive summaries, and dashboards supporting leadership reporting and cybersecurity readiness inspections, including CCRI and CORA assessments.
• Maintain ACAS asset inventories, credentialed scan configurations, asset groups, repositories, scan zones, and vulnerability data accuracy.
• Assist with vulnerability trend analysis, risk scoring, and continuous monitoring activities to improve enterprise cybersecurity posture.
• Support cybersecurity audits, inspections, accreditation activities, and system authorization efforts by providing required vulnerability documentation and evidence.
• Collaborate with cybersecurity engineers, system administrators, network engineers, and ISSOs to implement remediation strategies and security best practices.
• Maintain documentation including Standard Operating Procedures (SOPs), vulnerability management processes, scan schedules, and operational procedures.
• Ensure compliance with Department of Defense (DoD), Air Force, DISA, RMF, and organizational cybersecurity policies and standards.

Requirements

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related technical discipline; equivalent education and experience may be substituted.
• Minimum of four (4) years of professional cybersecurity or systems administration experience with at least one (1) year supporting vulnerability management, ACAS, Nessus, or Tenable SecurityCenter.
• Active DoD Secret Security Clearance.
• Current CompTIA Security+ CE or higher certification meeting DoD 8570/8140 IAT Level II requirements.
• Hands‑on experience performing vulnerability assessments using Tenable SecurityCenter, Nessus, or ACAS.
• Working knowledge of DISA Security Technical Implementation Guides (STIGs), SCAP Compliance Checker (SCC), and secure system configuration practices.
• Understanding of Risk Management Framework (RMF), NIST SP 800‑53 security controls, POA&Ms management, and Air Force cybersecurity policies.
• Experience reviewing vulnerability findings, validating scan results, identifying false positives, and supporting remediation efforts.
• Strong analytical, troubleshooting, documentation, and organizational skills with excellent attention to detail.
• Experience preparing technical reports, compliance documentation, vulnerability metrics, and executive summaries.
• Excellent written and verbal communication skills with the ability to effectively communicate technical information to both technical and non‑technical personnel.
• Ability to work independently while managing multiple priorities in a fast‑paced cybersecurity operations environment.

Preferred Qualifications

• Experience supporting United States Air Force (USAF), Department of Defense (DoD), DISA, or other federal government cybersecurity environments.
• Experience utilizing eMASS, SCAP Compliance Checker (SCC), HBSS, or other enterprise cybersecurity management tools.
• Experience supporting Command Cyber Readiness Inspection (CCRI), Command Cyber Operational Readiness Assessment (CORA), or similar cybersecurity inspections.
• Knowledge of Continuous Monitoring (ConMon) processes and vulnerability lifecycle management.
• Experience developing PowerShell scripts, Nessus API integrations, or automation solutions to streamline vulnerability management processes.
• Familiarity with Microsoft Windows Server, Red Hat Enterprise Linux (RHEL), VMware, Active Directory, and enterprise network infrastructure.
• Understanding of cybersecurity risk assessment methodologies, CVSS scoring, threat prioritization, and risk-based remediation strategies.
• Experience supporting Authorization to Operate (ATO) packages, security control assessments, and continuous authorization activities.
• Demonstrated ability to collaborate across cybersecurity, engineering, and operations teams supporting mission‑critical enterprise environments.

We are TIME Systems: Committed to Excellence, Dedicated to Service.

TIME Systems, LLC is an equal opportunity/affirmative action employer. All qualified applicants will receive consideration for employment without regard to sex, gender identity, sexual orientation, race, color, religion, national origin, disability, protected veteran status, age, or any other characteristic protected by law.