Cybersecurity Vulnerability Management Analyst IIISumma Health Full-Time / Benefit EligibleRemote Opportunity - Hybrid PreferredSumma Health is strengthening how we protect the systems our patients and caregivers depend on, and we're looking for someone who will find the weaknesses before anyone else does. If you've worked in vulnerability management, you know the scan results never end and that not every finding deserves the same urgency. We want the person who can tell the difference. You'll need the judgment to prioritize risk in a clinical environment, where some systems can't simply be patched and rebooted, and the communication skills to work with engineers, system owners, and clinical teams to get fixes done without disrupting care. We act with urgency, follow through, and own what we find.
Summary:
Under direction of the Manager, Cybersecurity Operations, the Cybersecurity Vulnerability Management Analyst is responsible for performing the tasks that support enterprise vulnerability identification, assessment, prioritization, and remediation tracking across the organization's technology environment, including on-premises infrastructure, cloud workloads, medical/IoT devices, and third-party connected systems.
Operates and maintains the organization's vulnerability scanning and assessment platform(s) (e.g., Rapid7 InsightVM), executes scheduled and ad hoc scanning activity, validates and triages findings, and applies risk-based prioritization using industry-standard scoring methodologies (e.g., CVSS, EPSS) in conjunction with asset criticality and business/clinical impact.
Coordinates with Infrastructure, Application Owners, Clinical Engineering, and third-party vendors to drive timely remediation of identified vulnerabilities and missing patches within established Service Level Agreements (SLAs), and documents risk exceptions, compensating controls, and Plans of Action and Milestones (POA&Ms) for vulnerabilities that cannot be remediated on standard timelines.
Monitors emerging Common Vulnerabilities and Exposures (CVEs), vendor security advisories, and threat intelligence to identify organizational exposure ahead of active exploitation, and produces recurring vulnerability management metrics, dashboards, and reporting to support Cybersecurity Governance, Risk, and Compliance (GRC) oversight and leadership decision-making.
1. Formal Education Required:
a. Bachelor's Degree or equivalent in Computer Science, Cybersecurity, IT, or Engineering or equivalent combination of education and/or experience.
2. Experience & Training Required:
a. Seven (7) years information security experience; Seven (7) years of IT related experience; Experience working in a complex healthcare environment.
b. Certifications required:
i. CompTIA Security+ (or equivalent)
ii. CompTIA CySA+ (or equivalent)
iii. CompTIA CASP (or equivalent)
c. Certifications preferred:
i. GIAC Vulnerability Assessor (GVFA) (or equivalent)
ii. CISSP (or equivalent)
3. Other Skills, Competencies and Qualifications:
a) Advanced knowledge of vulnerability scanning and assessment platforms (e.g., Rapid7 InsightVM, Tenable, Qualys) and scan configuration, credentialed/uncredentialed scanning, and agent-based assessment methods.
b) Advanced knowledge of vulnerability scoring frameworks (CVSS v3/v4) and exploit-probability models (e.g., EPSS), and their application to remediation prioritization.
c) Advanced knowledge of common vulnerability classes (e.g., buffer overflow, injection, misconfiguration, unpatched/end-of-life software, insecure default configurations) and their exploitation paths.
d) Advanced knowledge of enterprise patch management processes and tooling (e.g., WSUS, Microsoft Intune/SCCM, Ivanti) and coordination with Infrastructure/Endpoint teams on patch cycles.
e) Advanced knowledge of computer networking concepts and protocols, and network security methodologies (e.g., segmentation, firewalls, IDS/IPS).
f) Advanced knowledge of cloud infrastructure security posture management concepts as applied to vulnerability identification in IaaS/PaaS/SaaS environments.
g) Intermediate knowledge of medical device and operational technology (OT/IoMT) security considerations, including compensating controls where patching is not feasible.
h) Intermediate knowledge of server and client operating systems, and common hardening baselines (e.g., CIS Benchmarks).
i) Advanced knowledge of cyber threats, threat actor TTPs, and how emerging CVEs and advisories translate into organizational risk.
j) Basic knowledge of laws, regulations, policies, and ethics as they relate to cybersecurity and privacy, including HIPAA Security Rule implications of unremediated vulnerabilities.
k) Advanced skill in triaging scan output, eliminating false positives, and validating exploitability of findings.
l) Advanced skill in developing and tracking remediation plans, risk exceptions, and compensating controls in a GRC risk register.
m) Advanced skill in producing vulnerability management reporting, dashboards, and KPI/metrics packages for technical and executive audiences.
n) Basic skill in utilizing virtual collaborative workspaces and/or tools (e.g., SharePoint, Teams, ticketing/ITSM platforms).
o) Ability to communicate complex technical findings, concepts, or ideas in a confident and well-organized manner through verbal, written, and/or visual means.
p) Ability to evaluate information for reliability, validity, and relevance, and to synthesize scan data, asset context, and threat intelligence into prioritized remediation guidance.
q) Ability to function effectively in a dynamic, fast-paced environment with competing remediation priorities across clinical and business systems.
r) Ability to develop productive working relationships with a broad range of business, clinical, and operational professionals to drive remediation without unilateral authority over their systems.
s) Ability to negotiate resolutions for conflicting security and business/clinical operational objectives, including patch-window and downtime constraints.
t) Ability to exemplify Summa Health's core values.
u) Ability to take direction and operate independently in highly ambiguous situations.
v) Ability to effectively interact with populations of patients/customers with an understanding of their needs for self-respect and dignity.
4. Level of Physical Demands:
a. Sedentary: Exerts up to ten pounds of force occasionally and/or a negligible amount of force frequently.
b. Minimal, may occasionally move computer equipment (desktop, laptop, monitor, printer, and peripherals) when necessary.
Summa Health System is recognized as one of the region's top employers by a number of third party organizations, including NorthCoast 99. Exceptional candidates gravitate to Summa because of its culture, passion for delivering excellent service to our patients and families commitment to our philosophy of servant leadership, collegial working relationships at every level of the organization and competitive pay and benefits.
Equal Opportunity Employer/Veterans/Disabled
$54.76/hr - $82.14/hr
The salary range on this job posting/advertising is base salary exclusive of any bonuses or differentials. Many factors, such as years of relevant experience and geographical location are considered when determining the starting rate of pay. We believe in the importance of pay equity and consider internal equity of our current team members when determining offers. Please keep in mind that the range that is listed is the full base salary range. Hiring at the maximum of the range would not be typical.
Summa Health offers a competitive and comprehensive benefits program to include medical, dental, vision, life, paid time off as well as many other benefits.
- Basic Life and Accidental Death & Dismemberment (AD&D)
- Supplemental Life and AD&D
- Dependent Life Insurance
- Short-Term and Long-Term Disability
- Accident Insurance, Hospital Indemnity, and Critical Illness
- Retirement Savings Plan
- Flexible Spending Accounts - Healthcare and Dependent Care
- Employee Assistance Program (EAP)
- Identity Theft Protection
- Pet Insurance
- Education Assistance
- Daily Pay
