Security Analyst

Essential Duties and Responsibilities

Vulnerability Management

• Serve as the primary administrator for Tenable Security Center (SC) and Nessus vulnerability scanners.
• Perform authenticated and unauthenticated vulnerability scans across enterprise systems.
• Analyze scan results and prioritize remediation activities using CVSS scores, CISA Known Exploited Vulnerabilities (KEV), and organizational risk criteria.
• Produce recurring vulnerability reports for management, system owners, and compliance activities.
• Track remediation progress and validate vulnerability closures.
• Manage vulnerability waivers, risk acceptance documentation, and exception tracking.
• Monitor End-of-Life (EOL), End-of-Support (EOS), and Binding Operational Directive (BOD) vulnerability requirements.
• Coordinate with stakeholders across technical teams to drive timely vulnerability remediation efforts.

Security Operations

• Experience with:
• • Firewall Management
  • • Cisco
    • Checkpoint
  • IDS/IPS technologies
  • Log aggregation systems (Splunk)
  • File integrity monitoring solutions
  • Red Hat Linux
  • Windows workstation and server OS
  • MacOS
• Participate in incident investigations and support cybersecurity response activities.
• Assist with security assessments and continuous monitoring activities.

Application & Infrastructure Security

• Perform application vulnerability scanning.
• Coordinate vulnerability remediation with application owners.
• Support troubleshooting for application security issues.
• Partner with the Application Development team to identify security improvements throughout the software lifecycle.

Compliance & Reporting

Support organizational compliance initiatives including:

• NIST 800-53
• FISMA
• NIH/HHS cybersecurity policies
• CISA Binding Operational Directives (BODs)
• Continuous Monitoring (ConMon)

Prepare:

• Executive vulnerability reports
• Compliance dashboards
• Monthly security metrics
• Remediation status reports

Penetration Testing Remediation Support

Serve as the primary coordinator for annual penetration testing activities.

Responsibilities include:

• Coordinating testing schedules
• Supporting external penetration testing teams
• Managing findings
• Tracking remediation efforts
• Validating corrective actions
• Producing final response documentation

Operational Support

Provide day-to-day operational cybersecurity support including:

• Customer requests
• Security consultations
• Incident investigations
• Security engineering support
• Technical documentation

Security Frameworks

Working knowledge of:

• NIST 800-53
• NIST Cybersecurity Framework (CSF)
• Risk Management Framework (RMF)
• FISMA
• CISA Binding Operational Directives (BODs)
• Continuous Monitoring (ConMon)