Vulnerability Management Lead

Certifications : Either 1 or 2 prefered

• Rapid7 Certified Administrator (InsightVM) or equivalent

• GIAC Vulnerability Analyst (GEVA) or GPEN
• CompTIA Security+ / CySA+ or equivalent
• CISSP or CISM (senior-level certifications acceptable)
• CEH (Certified Ethical Hacker)
• Any relevant cybersecurity certification demonstrating vulnerability management expertise\

The Vulnerability Management Lead shall be responsible for coordinating enterprise vulnerability management activities, including tracking, remediation support, reporting, and trend analysis. This role ensures integration of vulnerability management into overall risk and compliance functions and supports enterprise-wide security operations.

Key Responsibilities

• Manage enterprise vulnerability management (VM) program using Rapid7 InsightVM as the primary scanning tool
• Coordinate application security findings from tools such as Veracode (SAST/DAST) and integrate them into VM workflows
• Integrate vulnerability findings into Jira for ticketing, tracking, and POA&M management (e.g., Xacta)
• Produce periodic vulnerability management reports including trends, severity, aging, remediation status, and risk recommendations
• Coordinate remediation activities with system owners and IT teams
• Support executive-level reporting and vulnerability trend analysis
• Ensure alignment with NIST vulnerability management guidance and federal compliance requirements

Required Qualifications & Experience

• Demonstrated experience managing enterprise vulnerability management programs
• Hands-on experience with Rapid7 InsightVM (configuration, scanning, reporting, dashboards)
• Experience integrating vulnerability data with SIEM tools (e.g., Splunk) for correlation and alerting
• Experience with Veracode SAST/DAST integration into security workflows
• Experience tracking vulnerabilities in Jira and managing POA&M updates in Xacta or similar GRC tools
• Strong understanding of vulnerability remediation lifecycle and SLA management (critical/high/medium/low timelines)
• Experience working in federal/FISMA environments (large-scale environments preferred, e.g., 1,500+ servers, ~18+ systems)
• Familiarity with Continuous Diagnostics and Mitigation (CDM) programs
• Prior experience as a VM lead or similar cybersecurity leadership role
• Experience with SCR-related vulnerability assessments (as applicable to program scope)