Vulnerability Analyst

Role: Vulnerability Analyst
Location: Remote
Duration: Long Term

Vulnerability Assessment
" Conduct security reviews of: z/OS operating system, RACF security controls, USS environments, Db2, MQ, CICS, JES, Batch processing, TCP/IP, Digital certificates, Middleware security, System-level privileged controls

Vulnerability Management
o Validate findings from vulnerability assessments.
o Analyze exploitability and risk.
o Categorize vulnerabilities based on severity and business impact.
o Establish remediation priorities.
o Track remediation progress.
o Support risk acceptance reviews.
o This aligns with Firm vulnerability management processes that require assessment, categorization, risk evaluation, and remediation governance.
Remediation Services

" Provide:
o Tactical remediation recommendations
o Strategic remediation roadmaps
o Compensating control recommendations
o Security architecture improvements
o Control design reviews
o Deployment guidance
o Remediation validation reviews
Audit & Compliance Support

" Support assessment activities related to:
o STIG
o PCI DSS
o NIST 800-53
o Internal audit
o Regulatory reviews
o Technology risk assessments

" Engage with vulnerability management teams to support EZ CVE reporting processes
" Define and finalize automation timelines for Patch Management
" Develop patch response models, including ad-hoc and immediate escalation scenarios
" Establish operational cadence (daily/weekly/monthly) for patching and validation
" Review CVE package stability and improve reporting/dashboard capabilities
" Enable SMP/E processes, define baseline datasets, and integrate with vulnerability scanning tools
" Develop AI-driven prompts and automation for testing, RFB validation, and impact analysis
" Provide advisory and implementation support for secure and stable patch deployment


Experience requirements
Experience
" 10+ years of IBM Z security experience.
" 10+ years of z/OS infrastructure experience.
" 5+ years of vulnerability management experience.
" Experience supporting large-scale financial services or regulated environments.

Technical Expertise
Expert-level knowledge of:
" z/OS
" RACF or Top Secret
" USS Security
" CICS Security
" MQ Security
" Db2 Security
" JES2/JES3
" TCP/IP Security
" SSL/TLS
" Digital Certificates
" Cryptographic controls
" SMF analysis
" zSecure
" Compliance Event Manager
" Mainframe audit tools

Preferred Skills
" STIG assessment experience
" NIST 800-53
" CIS Benchmarks
" PCI DSS
" Security architecture reviews
" Python / REXX automation
" AI-assisted vulnerability analysis
" Mainframe security monitoring solutions