Vulnerability Management Assessment SME (Hands-On)

Title – Vulnerability Management Assessment SME (Hands-On)

Location-Remote @ Atlanta, GA

Duration –Contract

Need someone who has done 2 VM assessments

We are looking for a hands-on, technical Vulnerability Management SME who has personally delivered enterprise VM assessments. This is not a governance-only or project-management role. The consultant will work directly in VM tools, analyze scan data, and deliver a risk-based assessment and roadmap within 8 weeks.

Mandatory Requirements

• At least 2 end-to-end vulnerability management program assessments personally delivered for enterprise clients, with the ability to explain the scope, methodology, findings, and outcome of each.
• 7+ years of hands-on technical vulnerability management experience.
• Deep hands-on administration of at least one of Tenable (SC/IO), Qualys VMDR, Rapid7 InsightVM, or Microsoft Defender VM, including scan configuration, credentials, policies, agents, tuning, and reporting.
• Can validate findings technically and identify false positives, scan coverage gaps, and authentication gaps.
• Strong technical knowledge of Windows, Linux, network devices, and cloud (AWS/Azure).
• Has built risk-based prioritization models using CVSS, EPSS, CISA KEV, and asset criticality.

Responsibilities

• Review scan configurations, coverage, credentialed scan success rates, and asset inventory accuracy directly in the tools.
• Analyze vulnerability data: aging, recurrence, SLA compliance, and remediation trends.
• Assess program maturity against NIST CSF and CIS Controls.
• Design the prioritization model, remediation SLA matrix, and exception process.
• Deliver the technical assessment report, a 12-month roadmap, and an executive readout.

Preferred

• Scripting in Python or PowerShell for scan data analysis or API automation
• Experience integrating with ServiceNow or SCCM/Intune
• Certifications: OSCP, GIAC (GEVA/GPEN), CISSP, or Tenable/Qualys certifications
• Local to the Atlanta area

Screening Requirements

• Candidates must describe 2 VM assessments they delivered: client industry, environment size, tools used, and key findings.
• A technical interview will include hands-on scenario questions on scan tuning, credentialed scanning, and prioritization

Regards,

Sai Srikar