Vulnerability Management Lead – DoD RMF/STIG Expert

Booz Allen Hamilton; Riverdale Park (MD); On-site; USD 99,000 - 225,000; Full time

Job summary

Booz Allen Hamilton is seeking a Vulnerability Management Lead to modernize ACAS deployments and design enterprise-scale STIG compliance for DoD clients. The role blends architecture, engineering, and advisory work to deliver repeatable cyber risk management and continuous monitoring.

The candidate will lead vulnerability workflows, RMF alignment, and automation efforts, while communicating risk posture to executives and stakeholders. TS/SCI clearance is required.

Qualifications

• Experience leading automation projects using Infrastructure as Code (IaC).
• Experience supporting DoD or IC cybersecurity programs.
• Experience with ACAS including Tenable.sc or Nessus in enterprise environments.
• Experience designing enterprise STIG compliance solutions.
• Knowledge of RMF, NIST 800-53, POA&M management, and continuous monitoring.
• Active TS/SCI clearance; willingness to take a polygraph.

Responsibilities

• Lead ACAS modernization efforts, transitioning scans to enterprise vulnerability management.
• Design contractor-operated workflows for vulnerability intake, remediation tracking, and risk acceptance.
• Integrate ACAS outputs into POA&M, ATO sustainment, and reporting requirements.
• Advise stakeholders on vulnerability prioritization, risk tradeoffs, and RMF integration.
• Automate repeatable tasks using scripting and workflow tooling.
• Produce executive-level briefings on cyber risk posture and remediation effectiveness.

Skills

IaC automation

DoD/IC programs

ACAS (Tenable/Nessus)

RMF & NIST 800-53

vulnerability management

Zero Trust alignment

Scripting (PowerShell/Python)

GRC/POA&M tooling

Education

Associate's degree + 5+ years IT

Bachelor's degree + 3+ years IT

Master's degree + 1+ years IT

Tools

ACAS (Tenable.sc)

OpenSCAP

SCC tooling

Xacta/eMASS

Job description

Booz Allen Hamilton is seeking a Vulnerability Management Lead to modernize ACAS deployments and design enterprise-scale STIG compliance for DoD clients. The role blends architecture, engineering, and advisory work to deliver repeatable cyber risk management and continuous monitoring.

The candidate will lead vulnerability workflows, RMF alignment, and automation efforts, while communicating risk posture to executives and stakeholders. TS/SCI clearance is required.