Vulnerability Management Analyst

📋 Description

• • Conduct regular vulnerability scanning of networks, servers, endpoints, cloud environments, and applications using approved tools such as Tenable (Nessus, Tenable.io), Qualys, Rapid7, Burp, Wiz, Prisma, and Microsoft Defender.
• • Analyze scan results to identify false positives, determine exploitability, and assess business and regulatory risk using CVSS and CMSS scoring systems.
• • Prioritize vulnerabilities based on CVSS scores, threat intelligence, asset criticality, and financial institution risk impact.
• • Track vulnerabilities through remediation, validation, and closure using ticketing and governance platforms, ensuring timely resolution and documentation.
• • Perform re-scans to validate the effectiveness of remediation efforts and confirm vulnerability closure.
• • Ensure vulnerability management practices align with FFIEC Cybersecurity Assessment Tool (CAT), NCUA regulatory guidance, GLBA Safeguards Rule, and internal Information Security and Risk Management policies.
• • Prepare documentation, metrics, and evidence for internal audits, regulatory exams, and third-party assessments, maintaining compliance posture.
• • Support risk acceptance decisions by documenting compensating controls and residual risk assessments.
• • Partner with IT infrastructure, application development, cloud, and network teams to remediate identified vulnerabilities and coordinate patching activities.
• • Translate technical vulnerability findings into clear business risk language for leadership and non-technical stakeholders.
• • Provide guidance on secure configuration standards (CIS Benchmarks), patch management processes, and vulnerability mitigation strategies.
• • Participate in security incident response activities when vulnerabilities are exploited or pose imminent risk to operations.
• • Monitor emerging threats, zero-day vulnerabilities, and industry advisories relevant to the financial services sector.
• • Contribute to the development and maintenance of vulnerability management policies, standards, procedures, training materials, and standard operating procedures.
• • Assist with penetration testing coordination and analysis of results to enhance overall security posture.
• • Collect, organize, and maintain security control evidence and artifacts for monthly continuous monitoring deliverables and assessment/authorization activities.
• • Maintain accurate system inventory and authorization boundary documentation to ensure scanning scope aligns with approved system boundaries.
• • Analyze scan results for false positives, document justifications, and prepare deviation requests with supporting risk assessments.
• • Participate in change management processes to ensure continuous monitoring activities remain aligned with system changes and compliance requirements.
• • Run regular and on-demand scans across operating systems, databases, web applications, and containers, creating remediation tickets for technical teams.
• • Track and document vendor dependencies, operational requirements, and open vulnerabilities, producing clear monthly reports and updates.
• • Run the daily vulnerability management program operations, working closely with the patch management analyst to identify and prioritize patching activities.
• • Actively participate in weekly vulnerability management team meetings to coordinate efforts and report progress.
• • Comply with all Federal Regulations pertaining to job duties, including BSA requirements.