Vulnerability Management Lead

ecsfederal; Virginia (MN); Hybrid; USD 115,000 - 135,000; Full time

Job summary

Everforth ECS is seeking a Remote Vulnerability Management Lead to guide enterprise vulnerability management within a national federal IT environment. The role emphasizes risk-based prioritization, cross-functional collaboration, and adherence to federal standards.

The position requires US citizenship, a Public Trust 6c clearance or ability to obtain, and proximity to the NCR for coordination with agency stakeholders.

Qualifications

• 6+ years of cybersecurity experience with vulnerability management, OS, and networking.
• Ability to work remotely while near the NCR region.
• Active Public Trust 6c clearance or ability to obtain.
• US citizenship required.
• Experience with federal compliance frameworks (NIST RMF, NIST SP 800-53, FISMA, FedRAMP).

Responsibilities

• Oversee enterprise vulnerability scanning operations, remediation tracking, and stakeholder communication with POA&M support across the program.
• Coordinate with ISOs, ISSOs, compliance, and engineering teams to identify and close security gaps.
• Lead ATO, POA&M and continuous monitoring activities.
• Develop dashboards and metrics for real-time visibility into vulnerability posture and remediation progress.
• Produce compliance reports and vulnerability governance data for audit readiness.

Skills

Cybersecurity

Vulnerability Mgmt

Communication

Policy & Governance

Tools

Tenable

AquaSec

CDM

Job description

Everforth ECS is seeking a Remote Vulnerability Management Lead who lives in close proximity to the National Capital Region (NCR) to join a premier, enterprise-scale cybersecurity program supporting a major federal civilian agency.

Please Note: This position is contingent upon contract award.

Salary Range: $115,000 - $135,000

This flagship initiative unifies 24x7x365 Security Operations (SOC), proactive threat hunting, and advanced Security Engineering and Architecture into a cohesive defensive mission. As a key leader on this program, you will drive the protection of highly sensitive, national-level financial and personally identifiable information (PII). You will be at the forefront of modernizing the agency's cyber posture, implementing advanced automation, and ensuring continuous operational resilience across a massive, highly complex federal IT enterprise.

As the Vulnerability Management Lead, you will serve as the principal technical authority for enterprise vulnerability identification, prioritization, and remediation across a large-scale federal civilian environment. Working closely with Information System Security Officers (ISSOs), Information System Owners (ISOs), compliance teams, and engineering personnel. You will drive a proactive, risk-based approach to vulnerability management, delivering measurable reductions in the agency's attack surface while ensuring continuous alignment with federal compliance requirements.

Position Responsibilities

• Oversee enterprise vulnerability scanning operations, remediation tracking, and stakeholder communication with POA&M support across the program.
• Coordinate with ISOs, ISSOs, compliance, and engineering teams to identify, prioritize, and close security gaps in a timely and risk-informed manner.
• Leads ATO, POA&M and continuous monitoring activities.
• Develop and maintain dashboards and metrics to provide real-time visibility into vulnerability management posture, trends, and remediation progress.
• Produce compliance reports and vulnerability governance data to support continuous monitoring, audit readiness, and cybersecurity decision-making.
• Manage integration of vulnerability management tools including Tenable, AquaSec, and the Continuous Diagnostics and Mitigation (CDM) program into enterprise workflows.
• Apply risk-based prioritization methodologies to ensure the most critical vulnerabilities are addressed in alignment with agency risk tolerance and compliance requirements.
• Support the review and maintenance of Plans of Action & Milestones (POA&Ms), ensuring timely and accurate tracking of identified vulnerabilities and remediation activities.
• Collaborate with SOC, threat hunting, and security engineering teams to correlate vulnerability data with active threat intelligence and hunting findings.
• Present vulnerability management findings, risk recommendations, and program metrics to both technical teams and senior government officials in a clear, actionable format.
• Develop and refine vulnerability management policies, procedures, and standard operating procedures to ensure alignment with federal regulations and agency requirements.

Support continuous monitoring activities and provide input into the overall security posture of the agency's federal IT enterprise.

• US. Citizenship required.
• 6+ years of cybersecurity experience, with demonstrated expertise in vulnerability management, operating systems, and networking.
• Remote but within close proximity to the NCR.
• Active Public Trust 6c clearance, or the ability to obtain and maintain one.
• At least one of the following certifications: GCIH, CISSP, CISM, or CRISC.
• Hands-on experience with Tenable, AquaSec, and CDM integration in a federal or enterprise environment.
• Strong understanding of federal compliance frameworks including NIST RMF, NIST SP 800-53, FISMA, and FedRAMP requirements.
• Experience developing and maintaining POA&Ms and supporting remediation tracking within federal information system environments.
• Demonstrated ability to coordinate cross-functional teams, including ISOs, ISSOs, compliance, and engineering stakeholders, to drive vulnerability remediation efforts.
• Proven ability to translate complex technical vulnerability findings into clear, actionable language for both technical and executive audiences.
• Strong written and verbal communication skills, with a track record of producing high-quality federal security documentation.