Vulnerability Management SME / Remote

Job Summary

We are looking for a hands-on, technical Vulnerability Management SME with strong experience conducting enterprise-level Vulnerability Management (VM) assessments.

The ideal candidate must have personally delivered at least two end-to-end enterprise Vulnerability Management program assessments and possess 7+ years of hands-on technical experience.

This role requires direct experience working with vulnerability management tools, analyzing scan results, validating findings, identifying security risks, and developing a risk-based remediation roadmap.

This is a technical role, not a governance-only or project management position.

Required Skills & Experience

• 7+ years of hands-on Vulnerability Management experience.
• Must have personally delivered at least 2 end-to-end enterprise Vulnerability Management program assessments.
• Strong hands-on administration experience with at least one of the following tools: Tenable Security Center / Qualys VMDR Rapid7 InsightVM Microsoft Defender Vulnerability Management.
• Experience configuring vulnerability scans, credentials, scanning policies, agents, tuning, and reporting.
• Ability to technically validate vulnerability findings and identify false positives, scan coverage gaps, and authentication issues.
• Strong technical knowledge of Windows, Linux, network devices, AWS, and Azure environments.
• Experience developing risk-based vulnerability prioritization models using CVSS, EPSS, CISA KEV, and asset criticality.

Roles & Responsibilities

• Review vulnerability scan configurations, scan coverage, credentialed scan success rates, and asset inventory accuracy directly within VM tools.
• Analyze vulnerability data, including vulnerability aging, recurrence, SLA compliance, and remediation trends.
• Assess the organization's Vulnerability Management program maturity against NIST CSF and CIS Controls.
• Develop risk-based vulnerability prioritization models.
• Define remediation SLAs, prioritization matrices, and vulnerability exception processes.
• Identify gaps in existing vulnerability management processes and recommend improvements.
• Prepare a comprehensive technical assessment report and a 12-month improvement roadmap.
• Present findings and recommendations to executive stakeholders.

Preferred Qualifications

• Experience with Python or PowerShell scripting for vulnerability data analysis and API automation.
• Experience integrating vulnerability management tools with ServiceNow, SCCM, or Microsoft Intune.
• Relevant certifications such as OSCP, GIAC (GEVA/GPEN), CISSP, Tenable, or Qualys certifications.