Vulnerability Management Analyst

- Lead the development, implementation, and ongoing enhancement of the enterprise vulnerability management program. - Use automated scanning tools (e.g., Qualys, Tenable, Rapid7, Wiz) to identify, evaluate, report, and monitor vulnerabilities across operating systems, databases, network devices, mobile devices, and cloud services. - Conduct advanced vulnerability assessments in on-premises, cloud, container, and hybrid environments. - Analyze vulnerability scan findings, prioritizing them based on risk, exploitability, and business impact. - Integrate threat intelligence and MITRE ATT&CK mappings to provide context for vulnerabilities and improve prioritization. - Work closely with infrastructure and business information security officers (BISO) to ensure prompt remediation and mitigation efforts. - Suggest and implement compensating controls when immediate remediation is impractical. - Create and manage metrics and dashboards to report on vulnerability trends, remediation progress, and overall risk posture. - Utilize automated compliance tools to verify configuration compliance for operating systems, databases, network devices, and cloud services. - Collaborate with IT and engineering departments to address configuration drift and guarantee continuous compliance. - Align configuration assurance controls with key regulatory frameworks (e.g., NIST, CIS, ISO 27001, PCI-DSS, HIPAA). - Keep accurate documentation of configuration standards and any exceptions. - Use data analytics to spot trends, anomalies, and risks across vulnerability and configuration datasets. - Develop and maintain dashboards and visualizations using tools like Tableau. - Present actionable insights to both technical and executive audiences to inform risk-based decision-making. - Automate processes by creating scripts and workflows to enhance scanning, reporting, and remediation tracking. - Incorporate vulnerability and configuration data into SIEM, GRC, and ticketing systems. - Provide executive-level reports and risk analyses to guide strategic decision-making. - Involve in both internal and external audit processes, ensuring evidence is available for vulnerability and configuration controls compliance. - Stay updated on emerging threats, vulnerabilities, and advancements in security technologies.