Vulnerability Management Engineer

Vulnerability Management Engineer

Location: Bethesda, MD (Hybrid; On-site as Required)

Clearance: Tier 2 Public Trust (Required)

Employment Type: Full-Time

Position Summary

Digital Global Connectors (DGC) is seeking an experienced Vulnerability Management Engineer to support a Federal information security program. The Vulnerability Management Engineer is responsible for identifying, assessing, prioritizing, tracking, and supporting the remediation of security vulnerabilities across enterprise information systems, cloud environments, applications, databases, network infrastructure, and endpoint devices.

This position performs enterprise vulnerability assessments, validates remediation efforts, supports continuous monitoring activities, and works closely with Security Engineers, ISSOs, System Administrators, Cloud Engineers, Security Operations Center (SOC) personnel, and program leadership to reduce organizational cyber risk and strengthen the overall cybersecurity posture.

The successful candidate will possess extensive experience administering enterprise vulnerability management platforms, performing technical vulnerability assessments, and implementing risk-based remediation strategies within large enterprise environments.

Essential Duties and Responsibilities:

Enterprise Vulnerability Assessments

• Conduct enterprise vulnerability assessments across servers, workstations, databases, network infrastructure, cloud environments, applications, and endpoint devices.
• Perform authenticated and unauthenticated vulnerability scans.
• Analyze vulnerability assessment results to determine severity and organizational impact.
• Validate scan accuracy and eliminate false positives.
• Identify systemic security weaknesses and recurring vulnerabilities.
• Maintain vulnerability assessment schedules supporting continuous monitoring activities.

Vulnerability Management

• Prioritize vulnerabilities using risk-based methodologies.
• Coordinate remediation activities with System Administrators, Cloud Engineers, Security Engineers, and System Owners.
• Track remediation progress through completion.
• Validate successful remediation of identified vulnerabilities.
• Recommend mitigation strategies when immediate remediation is not feasible.
• Monitor aging vulnerabilities and escalation thresholds.

Security Configuration Compliance

• Assess compliance with DISA Security Technical Implementation Guides (STIGs), CIS Benchmarks, Microsoft Security Baselines, and organizational configuration standards.
• Identify configuration weaknesses affecting system security.
• Recommend secure configuration improvements.
• Validate implementation of security hardening recommendations.
• Support configuration compliance reporting.
• Assist technical teams with remediation planning.

Vulnerability Assessment Tools

Administer and operate enterprise vulnerability management technologies including:

• Tenable Security Center
• Nessus Manager
• Nessus Professional
• Nessus Agents
• Microsoft Defender Vulnerability Management
• Qualys VMDR
• Rapid7 InsightVM
• Microsoft Defender for Cloud
• AWS Inspector
• Azure Security Center
• Security Content Automation Protocol (SCAP) tools

Maintain vulnerability scanning infrastructure and ensure scanning activities are performed efficiently and accurately.

Cloud Vulnerability Management

• Perform vulnerability assessments across Microsoft Azure, Microsoft 365, Amazon Web Services (AWS), and hybrid cloud environments.
• Assess cloud resource configurations for security weaknesses.
• Identify cloud misconfigurations and excessive permissions.
• Validate cloud security posture following remediation.
• Support cloud compliance initiatives.
• Recommend improvements to cloud vulnerability management processes.

Risk Management Framework (RMF) Support

• Support implementation of NIST SP 800-53 security controls related to vulnerability management.
• Provide technical evidence supporting Authorization to Operate (ATO) activities.
• Assist ISSOs and Security Assessors during Security Control Assessments (SCAs).
• Validate remediation of technical findings identified during security assessments.
• Support continuous monitoring reporting requirements.
• Maintain documentation supporting RMF activities.

Reporting and Metrics

Develop and maintain:

• Vulnerability Assessment Reports
• Executive Vulnerability Dashboards
• Remediation Status Reports
• POA&M Support Documentation
• Vulnerability Trend Reports
• Security Metrics
• Compliance Reports
• Continuous Monitoring Reports
• Risk Assessments
• Standard Operating Procedures

Ensure reporting accurately reflects enterprise vulnerability status and supports executive decision-making.

Collaboration

• Coordinate with Security Engineers, ISSOs, System Administrators, Cloud Engineers, SOC Analysts, Threat Hunters, Security Assessors, and Government stakeholders.
• Participate in vulnerability review meetings.
• Provide technical guidance regarding vulnerability remediation priorities.
• Support enterprise cybersecurity initiatives and security assessments.
• Assist with troubleshooting vulnerability scanning issues.

Continuous Improvement

• Monitor emerging vulnerabilities, Common Vulnerabilities and Exposures (CVEs), Common Weakness Enumerations (CWEs), and evolving attack techniques.
• Evaluate new vulnerability management technologies.
• Recommend improvements to enterprise vulnerability management processes.
• Support automation initiatives that improve vulnerability detection and remediation.
• Maintain professional certifications and technical expertise.

Minimum Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Systems, Engineering, or a related discipline.
• Minimum four (4) years of experience performing enterprise vulnerability management or vulnerability assessment activities.
• Experience administering Tenable, Qualys, Rapid7, Microsoft Defender Vulnerability Management, or comparable enterprise vulnerability management platforms.
• Experience supporting Windows, Linux, network, cloud, and hybrid environments.
• Familiarity with NIST SP 800-53, the Risk Management Framework (RMF), and Federal cybersecurity requirements.
• Strong analytical, troubleshooting, documentation, and communication skills.
• U.S. Citizenship required.
• Ability to obtain and maintain a Tier 2 Public Trust.

Preferred Qualifications

• Master's degree in Cybersecurity, Information Assurance, Computer Science, Engineering, or a related discipline.
• Experience supporting a Federal civilian agency.
• Experience supporting Microsoft Azure, Microsoft 365, or AWS cloud environments.
• Experience implementing Security Content Automation Protocol (SCAP) compliance tools.
• Tenable Certified Nessus Expert
• CompTIA CySA+
• CompTIA Security+
• GIAC Continuous Monitoring Certification (GMON)
• Certified Information Systems Security Professional (CISSP) (preferred)
• Microsoft Certified: Azure Security Engineer Associate (AZ-500) (preferred)

Knowledge, Skills, and Abilities

• Vulnerability Management
• Vulnerability Assessments
• Risk-Based Vulnerability Prioritization
• Tenable Security Center
• Nessus
• Microsoft Defender Vulnerability Management
• Qualys VMDR
• Rapid7 InsightVM
• Microsoft Defender for Cloud
• AWS Inspector
• Azure Security Center
• DISA STIGs
• CIS Benchmarks
• Security Configuration Compliance
• Security Content Automation Protocol (SCAP)
• Windows Security
• Linux Security
• Cloud Security
• Microsoft Azure
• Amazon Web Services (AWS)
• Risk Management Framework (RMF)
• NIST SP 800-53
• Federal Information Security Modernization Act (FISMA)
• Common Vulnerabilities and Exposures (CVEs)
• Common Weakness Enumeration (CWE)
• POA&M Management
• Technical Documentation
• Microsoft Office Suite
• ServiceNow
• Jira

Security Requirements

• Ability to successfully obtain and maintain a Tier 2 Public Trust investigation.
• Compliance with all applicable Federal security, privacy, ethics, and information assurance training requirements before receiving system access.
• Ability to support enterprise vulnerability management operations, scheduled maintenance windows, continuity of operations (COOP), emergency response activities, and surge support as required.
• Must maintain strict confidentiality while handling vulnerability assessment data, system configurations, compliance findings, remediation information, and Federal information systems.
• Ability to identify, assess, prioritize, and support remediation of enterprise vulnerabilities while collaborating with Government stakeholders, technical teams, and program leadership to reduce organizational cyber risk and improve the security posture of enterprise information systems.