Principal Cybersecurity Analyst - Vulnerability Management

Leads the Vulnerability Management Program by defining program strategy, developing/improving core processes, managing daily workflows, and directing the team to deliver efficient, consistent execution for stakeholders.

Vulnerability Management Program Leadership & Governance
Lead the operations and strategic direction of the institution’s cybersecurity vulnerability management program to identify, prioritize, and remediate vulnerabilities and reduce risk to patient care, research, and clinical operations.

Develop and drive strategic improvements to program governance, processes, and workflow efficiency across the vulnerability management lifecycle.

Establish and refine program standards, policies, and procedures aligned with institutional risk tolerance and regulatory requirements.

Team Supervision, Guidance & Subject Matter Expertise
Supervise, mentor, and develop a team of vulnerability management staff; set priorities, manage workload, and support professional growth and performance.

Serve as the subject matter expert for vulnerability management, providing technical guidance, escalation support, and coaching to team members.

Foster a culture of accountability, collaboration, and continuous improvement.

Cross-Functional Partnerships & Collaboration
Develop and enhance partnerships with IT, infrastructure, application, and biomedical/clinical support teams to improve cross-functional effectiveness and collaboration.

Coordinate remediation efforts with system and application owners, ensuring shared understanding of risk, priorities, and timelines.

Serve as a liaison between Cybersecurity and support teams to resolve barriers and drive timely, effective remediation.

Performance Monitoring & Structured Program Reviews
Conduct structured weekly and monthly reviews to ensure alignment on issues, updates, and performance data.

Define, track, and report key performance indicators (KPIs) and key risk indicators (KRIs) to measure program health and inform data-driven decisions.

Identify trends, gaps, and improvement opportunities from performance data and take corrective action.

SLA Management & Cybersecurity Point of Contact
Serve as the point of contact for Cybersecurity to ensure vulnerability management service level agreements (SLAs) are consistently met.

Monitor SLA compliance, escalate at-risk items, and coordinate remediation to meet or exceed defined targets.

Communicate program status, risks, and SLA performance to leadership and stakeholders.

Program Documentation & Reporting
Develop and maintain comprehensive program documentation, including standard operating procedures, runbooks, workflows, and reporting, to ensure accuracy, clarity, and auditability.

Ensure documentation supports consistent execution, onboarding, knowledge transfer, and audit readiness.

Leadership Support & Special Assignments
Complete designated tasks, projects, and responsibilities as assigned by leadership.

Support departmental and institutional cybersecurity initiatives and continuous improvement efforts as needed.

Other duties as assigned