Vulnerability Management Lead: DoD RMF & STIG Expert

Booz Allen Hamilton; Norfolk (VA); On-site; USD 99,000 - 225,000; Full time

Job summary

Booz Allen Hamilton is seeking a Vulnerability Management Lead to modernize ACAS capabilities for DoD clients and design enterprise-scale STIG solutions. You will act as a trusted advisor bridging architecture, engineering, and client influence to deliver repeatable cyber risk management and continuous monitoring.

The role requires deep RMF/NIST knowledge, TS/SCI clearance, and hands-on automation leadership, with responsibility for policy standardization, workflow design, and executive-level

Qualifications

• 4+ years of experience leading automation projects using IaC.
• 3+ years of experience supporting DoD or IC cybersecurity programs.
• Experience with ACAS (Tenable.sc or Nessus) in enterprise environments.
• Experience designing enterprise STIG compliance solutions.
• Knowledge of RMF, NIST 800-53, POA&M management, and continuous monitoring.
• Active TS/SCI clearance; willingness to take a polygraph exam.
• Ability to obtain DoD 8570 IAT Level III Certification within 60 days of start date.
• Ability to obtain DoD 8570.01-M CSP Certification within 30 days of start date.

Responsibilities

• Lead ACAS modernization efforts for enterprise vulnerability management.
• Modernize ACAS implementation: standardize scan policies, credentialed coverage, asset tagging, data hygiene.
• Design contractor-operated workflows for vulnerability intake, prioritization, remediation tracking, and risk acceptance.
• Integrate ACAS outputs into POA&M, ATO sustainment, and reporting requirements.
• Advise stakeholders on vulnerability prioritization, risk tradeoffs, and RMF integration.
• Collaborate with cyber engineering, architecture, and RMF teams to align VM with Zero Trust initiatives.
• Produce executive briefings on cyber risk posture and remediation effectiveness.
• Develop enterprise STIG compliance frameworks to enable inheritance, reuse, and automation.
• Standardize STIG baselines and documentation to reduce per-system burden.
• Implement and maintain SCAP/STIG tooling across servers, endpoints, and platforms.
• Produce defensible STIG artifacts for ATOs and continuous monitoring.
• Advise system owners on remediation strategies and risk-based deviations.
• Automate repeatable tasks using scripting and workflow tools.
• Integrate ACAS and STIG outputs with ticketing, GRC, or reporting systems.

Skills

IaC automation leadership

DoD/IC cybersecurity experience

STIG compliance design

RMF & NIST 800-53

TS/SCI clearance

8570 IAT certifications

8570-CSP certifications

Python scripting

PowerShell scripting

SQL

Cloud (AWS GovCloud, Azure Government)

Education

Associate's degree or higher in IT or related field

Tools

ACAS (Tenable.sc/Nessus)

Job description

Booz Allen Hamilton is seeking a Vulnerability Management Lead to modernize ACAS capabilities for DoD clients and design enterprise-scale STIG solutions. You will act as a trusted advisor bridging architecture, engineering, and client influence to deliver repeatable cyber risk management and continuous monitoring.

The role requires deep RMF/NIST knowledge, TS/SCI clearance, and hands-on automation leadership, with responsibility for policy standardization, workflow design, and executive-level