Vulnerability Management Assessment SME
Remote
Long Term
At least 2 end-to-end vulnerability management program assessments personally delivered for enterprise clients, with the ability to explain the scope, methodology, findings, and outcome of each.
7+ years of hands-on technical vulnerability management experience.
Deep hands-on administration of at least one of Tenable (SC/IO), Qualys VMDR, Rapid7 InsightVM, or Microsoft Defender VM, including scan configuration, credentials, policies, agents, tuning, and reporting.
Can validate findings technically and identify false positives, scan coverage gaps, and authentication gaps.
Strong technical knowledge of Windows, Linux, network devices, and cloud (AWS/Azure).
Has built risk-based prioritization models using CVSS, EPSS, CISA KEV, and asset criticality.
Responsibilities
Review scan configurations, coverage, credentialed scan success rates, and asset inventory accuracy directly in the tools.
Analyze vulnerability data: aging, recurrence, SLA compliance, and remediation trends.
Assess program maturity against NIST CSF and CIS Controls.
Design the prioritization model, remediation SLA matrix, and exception process.
Deliver the technical assessment report, a 12-month roadmap, and an executive readout.
Preferred
Scripting in Python or PowerShell for scan data analysis or API automation
Experience integrating with ServiceNow or SCCM/Intune
Certifications: OSCP, GIAC (GEVA/GPEN), CISSP, or Tenable/Qualys certifications