NorthHill Technology
VULNERABILITY MANAGEMENT ENGINEER (HYBRID)
NorthHill Technology, Washington, District of Columbia, us, 20022
NorthHill Technology Resources has an immediate need for a Vulnerability Management Engineer to support a Federal Program in Washington, DC. This is a hybrid role, with 2 days onsite and 3 days remote per week. Due to the nature of the work, US Citizenship and ability to obtain Public Trust Clearance is required.
Job Title: Vulnerability Management Engineer
Location: Hybrid - Remote, and Onsite (Washington, DC)
Job Overview
We are seeking a highly skilled Vulnerability Management Engineer to manage and enhance our vulnerability management processes. The ideal candidate will leverage a deep technical understanding of vulnerability assessment tools, penetration testing techniques, and risk mitigation strategies to discover, prioritize, and remediate vulnerabilities within our hybrid Microsoft environment. As a critical member of our cybersecurity team, you will be responsible for performing in-depth vulnerability analysis, driving remediation efforts, and optimizing security solutions to mitigate identified risks effectively.
Key Responsibilities
Vulnerability Analysis & Penetration Testing:
•Conduct in-depth vulnerability assessments using tools such as Nessus, Qualys, SecurityCenter, and NMAP to identify, analyze, and validate vulnerabilities across systems and networks.
•Develop and implement countermeasures and remediations for vulnerabilities, prioritizing based on risk exposure, asset criticality, and exploitability.
•Perform regular vulnerability scans, analyzing scan results and integrating findings into risk management strategies.
•Utilize penetration testing methodologies to simulate attacks and identify potential exploitation points in the environment.
•Collaborate with development and operations teams to validate vulnerabilities and suggest mitigation strategies tailored to the environment.
•Provide detailed technical reports and advisories to stakeholders, including risk impact analysis and risk mitigation recommendations.
Data Analysis & Scripting:
•Query and analyze vulnerability scan data using SQL, Python, and other scripting languages to identify trends, assess impact, and support decision-making.
•Automate vulnerability scanning, reporting, and analysis processes through custom scripts and integrations with security tools.
•Create and maintain dashboards and reporting tools to track vulnerability remediation progress and key performance indicators (KPIs).
•Build and optimize data pipelines to enhance the ingestion and processing of vulnerability data from multiple sources.
Vulnerability Remediation & Risk Mitigation:
•Lead vulnerability remediation efforts by coordinating with stakeholders and IT teams to implement patches, configuration changes, or other mitigation actions.
•Perform post-remediation validation to ensure that vulnerabilities have been effectively addressed and that no new vulnerabilities have been introduced.
•Develop and enforce vulnerability management policies, including patch management workflows, exception handling, and remediation timelines.
•Drive continuous improvement initiatives to enhance the efficiency and effectiveness of vulnerability management practices across the organization.
Tool & Process Optimization:
•Evaluate, configure, and optimize vulnerability management tools and processes to ensure maximum coverage and accuracy.
•Stay current with emerging vulnerabilities, threat intelligence, and evolving industry best practices to adapt and improve security measures.
•Collaborate with other security engineers to integrate vulnerability management into broader SIEM, IDS/IPS, and endpoint protection strategies.
Qualifications
•Experience:
o At least 3+ years of hands-on experience in vulnerability management and penetration testing in a complex network environment.
o Minimum 2 years of experience working with vulnerability scanning and reporting tools like Nessus, Qualys, SecurityCenter, and NMAP.
o At least 2 years of experience in data analysis, including the use of SQL, Python, and other relevant scripting languages for data manipulation and automation.
o Experience in managing vulnerabilities in hybrid Microsoft environments (e.g., Active Directory, Exchange, and Windows Server).
o Proven experience with patch management and remediation processes, including integrating patching into existing workflows and systems.
o Experience working with security frameworks such as CIS, NIST, ISO 27001, or OWASP.
•Certifications (Required):
o One or more active security certifications such as CISSP, CEH, CompTIA Security+, or GIAC related to vulnerability management.
•Education:
o Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related technical field, or equivalent practical experience.
•Skills:
o Advanced knowledge of network protocols (e.g., TCP/IP, DNS, HTTP, SSL/TLS) and common attack vectors.
o Proficiency with security tools and technologies such as SIEM (e.g., Splunk), EDR (e.g., CrowdStrike), firewalls, and IDS/IPS.
o Strong understanding of operating systems (Linux, Windows, macOS) and network architecture.
o Familiarity with containerized environments (e.g., Docker, Kubernetes) and cloud platforms (e.g., AWS, Azure) is a plus.
Desired Skills & Attributes
•Analytical Mindset: Ability to critically assess vulnerabilities, assess risk impact, and prioritize remediation actions based on business needs.
•Automation Expertise: Experience automating vulnerability management processes and reporting using PowerShell, Python, or other scripting languages.
•Collaboration: Ability to work effectively with cross-functional teams, including IT operations, network security, and software development teams.
•Communication: Strong ability to present complex technical findings to non-technical stakeholders and provide actionable recommendations.
•Attention to Detail: Meticulous in tracking and reporting vulnerabilities and remediation status, ensuring that no details are overlooked.
Job Title: Vulnerability Management Engineer
Location: Hybrid - Remote, and Onsite (Washington, DC)
Job Overview
We are seeking a highly skilled Vulnerability Management Engineer to manage and enhance our vulnerability management processes. The ideal candidate will leverage a deep technical understanding of vulnerability assessment tools, penetration testing techniques, and risk mitigation strategies to discover, prioritize, and remediate vulnerabilities within our hybrid Microsoft environment. As a critical member of our cybersecurity team, you will be responsible for performing in-depth vulnerability analysis, driving remediation efforts, and optimizing security solutions to mitigate identified risks effectively.
Key Responsibilities
Vulnerability Analysis & Penetration Testing:
•Conduct in-depth vulnerability assessments using tools such as Nessus, Qualys, SecurityCenter, and NMAP to identify, analyze, and validate vulnerabilities across systems and networks.
•Develop and implement countermeasures and remediations for vulnerabilities, prioritizing based on risk exposure, asset criticality, and exploitability.
•Perform regular vulnerability scans, analyzing scan results and integrating findings into risk management strategies.
•Utilize penetration testing methodologies to simulate attacks and identify potential exploitation points in the environment.
•Collaborate with development and operations teams to validate vulnerabilities and suggest mitigation strategies tailored to the environment.
•Provide detailed technical reports and advisories to stakeholders, including risk impact analysis and risk mitigation recommendations.
Data Analysis & Scripting:
•Query and analyze vulnerability scan data using SQL, Python, and other scripting languages to identify trends, assess impact, and support decision-making.
•Automate vulnerability scanning, reporting, and analysis processes through custom scripts and integrations with security tools.
•Create and maintain dashboards and reporting tools to track vulnerability remediation progress and key performance indicators (KPIs).
•Build and optimize data pipelines to enhance the ingestion and processing of vulnerability data from multiple sources.
Vulnerability Remediation & Risk Mitigation:
•Lead vulnerability remediation efforts by coordinating with stakeholders and IT teams to implement patches, configuration changes, or other mitigation actions.
•Perform post-remediation validation to ensure that vulnerabilities have been effectively addressed and that no new vulnerabilities have been introduced.
•Develop and enforce vulnerability management policies, including patch management workflows, exception handling, and remediation timelines.
•Drive continuous improvement initiatives to enhance the efficiency and effectiveness of vulnerability management practices across the organization.
Tool & Process Optimization:
•Evaluate, configure, and optimize vulnerability management tools and processes to ensure maximum coverage and accuracy.
•Stay current with emerging vulnerabilities, threat intelligence, and evolving industry best practices to adapt and improve security measures.
•Collaborate with other security engineers to integrate vulnerability management into broader SIEM, IDS/IPS, and endpoint protection strategies.
Qualifications
•Experience:
o At least 3+ years of hands-on experience in vulnerability management and penetration testing in a complex network environment.
o Minimum 2 years of experience working with vulnerability scanning and reporting tools like Nessus, Qualys, SecurityCenter, and NMAP.
o At least 2 years of experience in data analysis, including the use of SQL, Python, and other relevant scripting languages for data manipulation and automation.
o Experience in managing vulnerabilities in hybrid Microsoft environments (e.g., Active Directory, Exchange, and Windows Server).
o Proven experience with patch management and remediation processes, including integrating patching into existing workflows and systems.
o Experience working with security frameworks such as CIS, NIST, ISO 27001, or OWASP.
•Certifications (Required):
o One or more active security certifications such as CISSP, CEH, CompTIA Security+, or GIAC related to vulnerability management.
•Education:
o Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related technical field, or equivalent practical experience.
•Skills:
o Advanced knowledge of network protocols (e.g., TCP/IP, DNS, HTTP, SSL/TLS) and common attack vectors.
o Proficiency with security tools and technologies such as SIEM (e.g., Splunk), EDR (e.g., CrowdStrike), firewalls, and IDS/IPS.
o Strong understanding of operating systems (Linux, Windows, macOS) and network architecture.
o Familiarity with containerized environments (e.g., Docker, Kubernetes) and cloud platforms (e.g., AWS, Azure) is a plus.
Desired Skills & Attributes
•Analytical Mindset: Ability to critically assess vulnerabilities, assess risk impact, and prioritize remediation actions based on business needs.
•Automation Expertise: Experience automating vulnerability management processes and reporting using PowerShell, Python, or other scripting languages.
•Collaboration: Ability to work effectively with cross-functional teams, including IT operations, network security, and software development teams.
•Communication: Strong ability to present complex technical findings to non-technical stakeholders and provide actionable recommendations.
•Attention to Detail: Meticulous in tracking and reporting vulnerabilities and remediation status, ensuring that no details are overlooked.