Vulnerability Risk Analyst — NIST & Web App Security

Security 1st Consulting; Newport News, Northern (VA, KY); Hybrid; USD 90,000 - 120,000; Full time

Job summary

Security 1st Consulting in the United States (Virginia) seeks a Vulnerability Assessment Analyst to perform comprehensive scans across NNPS networks, web apps, and business systems, producing findings tied to real business risk. You will work with the Senior Penetration Tester to translate results into prioritized reports and ensure documentation supports compliance with security controls.

Ideal candidates have experience with OpenVAS, Nessus, or Qualys, and a working knowledge of NIST 800-53.

Qualifications

• 3+ years of vulnerability assessment experience in enterprise environments.
• Proficient with OpenVAS, Nessus, Qualys or equivalent tooling.
• Working knowledge of NIST 800-53 and risk-based prioritization.
• Experience conducting web application security assessments.
• Strong documentation with business context.

Responsibilities

• Conduct external and internal vulnerability scans of NNPS systems and network infrastructure.
• Assess network security architecture against NIST 800-53 controls and identify gaps.
• Perform web application security assessments for NNPS-hosted applications.
• Assess NNPS public-facing web properties for vulnerabilities.
• Evaluate HR, Payroll, and Business Office systems for sensitive data risks.
• Correlate scan results against NIST 800-53 and produce prioritized findings reports.
• Collaborate with internal scanning agents as needed.
• Coordinate with the Senior Penetration Tester to share findings and inform priorities.

Skills

Vulnerability assessment

Web application security

NIST 800-53 knowledge

Documentation

Team collaboration

Education

CEH

CompTIA PenTest+

Tools

OpenVAS

Nessus

Qualys

Job description

Security 1st Consulting in the United States (Virginia) seeks a Vulnerability Assessment Analyst to perform comprehensive scans across NNPS networks, web apps, and business systems, producing findings tied to real business risk. You will work with the Senior Penetration Tester to translate results into prioritized reports and ensure documentation supports compliance with security controls.

Ideal candidates have experience with OpenVAS, Nessus, or Qualys, and a working knowledge of NIST 800-53.