Vulnerability & Patch Management Analyst (HYBRID, NYC)

Michael Page; New York (NY); On-site; USD 120,000 - 180,000; Full time

Benefits offered by this job

Health benefits from day-1

Job summary

Michael Page is seeking a Cybersecurity/Vulnerability Analyst in New York City to manage the vulnerability and patch management lifecycle, identify risks, and track remediation. The role includes developing security reporting and improving vulnerability management processes.

The position requires 3 days onsite each week in Midtown, NYC, with collaboration across Americas and international teams. 5+ years in related roles and strong SIEM, reporting, and vulnerability tooling capabilities are

Qualifications

• Minimum 5 years in vulnerability management, patch management, or related security role.
• Experience overseeing POA&Ms.
• Strong understanding of vulnerabilities and risk impact on systems and infrastructure.
• Hands-on with vulnerability management tools including scanning, treatment and remediation.
• Experience with SIEM dashboards and reports.

Responsibilities

• Manage full vulnerability and patch lifecycle across infrastructure, systems, apps, and SDLC.
• Analyze event data for attack indicators and breaches.
• Prioritize patches based on risk and manage SLA breaches.
• Develop and deliver vulnerability/patch reporting for leadership and tech teams.
• Create and adapt KPIs/KRIs for a risk-based vulnerability program.

Skills

Vulnerability management

Patch management

SIEM experience

Reporting & data analysis

Power BI

Excel / Power Query

Scripting

Communication

Auditing & controls

Education

Bachelor's degree in Information Assurance / Information Security / Computer Science

Tools

Power BI

SIEM tools

Vulnerability scanners

Excel

Job description

We're seeking a Cybersecurity/Vulnerability Analyst to manage the vulnerability and patch management lifecycle, including identifying vulnerabilities, prioritizing risk, and tracking remediation. This person will also develop security reporting and improve vulnerability management processes. This role requires 3-days onsite each week in Midtown, NYC.

A growing financial services firm in NYC.

Description

We're seeking a Cybersecurity/Vulnerability Analyst to manage the vulnerability and patch management lifecycle, including identifying vulnerabilities, prioritizing risk, and tracking remediation. This person will also develop security reporting and improve vulnerability management processes. This role requires 3-days onsite each week in Midtown, NYC.

• Manage the full vulnerability and patch management lifecycle, including identification, prioritization, tracking, and remediation across infrastructure, systems, applications, and the SDLC.
• Analyze cybersecurity event data and other data sources for potential attack indicators and security breaches.
• Assess vulnerabilities to determine their potential impact and overall risk to systems and infrastructure.
• Prioritize patch deployments based on risk and manage SLA breaches, including developing and executing follow-up plans.
• Monitor vulnerability remediation efforts and ensure vulnerabilities are addressed in a timely manner.
• Conduct vulnerability scans and support vulnerability treatment and remediation activities.
• Develop and deliver vulnerability and patch management reporting for leadership and relevant technology teams.
• Develop and present key performance indicators (KPIs) and adapt key risk indicators (KRIs) to support a risk-based vulnerability management approach.
• Monitor the effectiveness of the patch management program and recommend improvements.
• Design, enhance, and maintain vulnerability and patch management procedures, processes, playbooks, and runbooks.
• Coordinate the development and ongoing maintenance of the organization's patch management strategy.
• Assist IT teams with acquiring and deploying vendor patches and software/system updates.
• Collaborate with IT and security stakeholders across the Americas and international teams.
• Work with Second Line of Defense teams and auditors as needed.
• Strengthen compliance with cybersecurity standards, security best practices, and approved tools.
• Support cybersecurity projects, security incidents, and audit remediation activities as needed.
• Ensure security monitoring systems remain online, current, and operational.
• Identify opportunities to use AI to automate manual cybersecurity processes and tasks.
• Provide off-hours support when needed to address emerging security threats.

Profile

• Minimum of 5 years of experience in vulnerability management, patch management, cybersecurity, or a related security role.
• Experience overseeing Plans of Action and Milestones (POA&M).
• Strong understanding of common cybersecurity vulnerabilities and the ability to assess their impact on systems and infrastructure.
• Hands‑on experience with vulnerability management tools, including vulnerability scanning, treatment, and remediation.
• Experience working with SIEM tools, including building dashboards and reports.
• Strong experience with reporting and data analysis tools, including Power BI, advanced Excel, and Power Query.
• Experience working with datasets and pivot tables.
• Scripting experience.
• Experience creating and enhancing cybersecurity documentation, including procedures, playbooks, and runbooks.
• Deep understanding of network devices and architecture, TCP/IP, network protocols, server operating systems, and vulnerability scanning.
• Knowledge of Windows, Linux/Unix, VMware, IDS/IP, and forensic discovery.
• Strong understanding of internal controls and experience improving cybersecurity processes, procedures, and documentation.
• Knowledge of cybersecurity and IT audit frameworks and standards, including NIST, FFIEC, ISO 27001, NIST CSF, and CIS.
• Ability to create management‑level presentation materials and clearly communicate cybersecurity risks, findings, and recommendations.
• Strong communication and collaboration skills with the ability to work across multiple technical and business teams.
• Ability to use AI to automate manual processes and tasks.
• Bachelor's degree in Information Assurance, Information Security, Computer Science, a related field, and/or equivalent professional experience.
• CISSP, CISM, GCIH, GCIA, or GPEN certification is preferred but not required.

Job Offer

• Access to Michael Page health benefits beginning day-1 of employment!

MPI does not discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity or expression, national origin, age, disability, veteran status, marital status, or based on an individual's status in any group or class protected by applicable federal, state or local law. MPI encourages applications from minorities, women, the disabled, protected veterans and all other qualified applicants.