Vulnerability Patch Management Analyst

Job Description

A client of ours has a need for a Vulnerability Patch Management Analyst for their Midtown Manhattan office in NYC. This position is a contract hybrid role with 3 days a week in the office.

\n

\n

ONLY W2, must be a US citizen or GC Holder. NO vendors.

\n

\n

Key Responsibilities

\n

Vulnerability & Patch Management

\n

\n
• Manage the end-to-end vulnerability and patch management lifecycle, including identification, assessment, prioritization, remediation, and validation across infrastructure, applications, systems, network devices, and the software development lifecycle (SDLC).
\n
• Develop and implement risk-based remediation strategies that align vulnerability severity, business impact, and established remediation SLAs.
\n
• Monitor remediation progress, identify SLA breaches, maintain Plans of Action and Milestones (POA&Ms), and drive follow-up actions with responsible IT teams.
\n
• Coordinate with IT teams to obtain, test, and deploy vendor patches and security updates in a timely manner.
\n
• Assess vulnerability exposure and treatment options to ensure remediation efforts are focused on the most critical risks.
\n
• Develop, maintain, and enhance VPM policies, procedures, process documentation, playbooks, and runbooks.
\n
• Establish and maintain a comprehensive patch management strategy, strengthening governance, accountability, and operational effectiveness.
\n

\n

Cybersecurity Monitoring & Incident Response

\n

\n
• Analyze security event data, SIEM alerts, and other relevant data sources to identify indicators of attack, suspicious activity, and potential security breaches.
\n
• Produce incident reports, support incident coordination, and collaborate with cybersecurity defense teams to facilitate timely investigation and response.
\n
• Coordinate with defense teams to ensure security monitoring tools and systems remain operational, current, and effective.
\n
• Provide backup support for cybersecurity incidents, projects, and audit remediation activities, including off-hours support when required.
\n

\n

Risk, Governance & Compliance

\n

\n
• Evaluate vulnerability and patch management effectiveness, ensuring alignment with internal policies, security standards, regulatory expectations, and industry best practices.
\n
• Collaborate with the Second Line of Defense (2LOD), IT Risk, Compliance, and internal and external auditors to support control assessments, audit requests, and remediation activities.
\n
• Support vulnerability assessments, track system and software updates, and strengthen adherence to approved security tools and processes.
\n
• Stay informed of emerging threats, industry trends, and evolving cybersecurity requirements to recommend continuous program improvements.
\n

\n

Reporting, Analytics & Program Enhancement

\n

\n
• Develop, maintain, and present key performance indicators (KPIs), key risk indicators (KRIs), dashboards, and management reports that provide clear visibility into vulnerability exposure, remediation progress, SLA performance, and program effectiveness.
\n
• Deliver accurate, consistent, and actionable reporting to senior management, technology stakeholders, and cybersecurity leadership.
\n
• Use data analytics, advanced Excel, Power Query, Power BI, scripting, and AI-enabled automation to streamline manual processes, improve data quality, and enhance operational efficiency.
\n
• Translate complex technical findings into clear, actionable insights and strategic recommendations for stakeholders.
\n
• Lead initiatives to improve the Americas CIB Vulnerability & Patch Management program through enhanced processes, reporting, automation, and risk-based decision-making.
\n

\n

\n

Required Qualifications & Technical Skills

\n

\n
• Experience: 5–9 years of relevant experience in vulnerability management, patch management, cybersecurity operations, IT risk, or a related information security role.
\n
• Vulnerability & Patch Management: Demonstrated experience managing vulnerability identification, scanning, risk assessment, remediation tracking, patch deployment, SLA monitoring, and POA&Ms.
\n
• Security Monitoring: Hands-on experience with Security Information and Event Management (SIEM) tools, including alert analysis, dashboard development, and security reporting.
\n
• Vulnerability Management Tools: Experience conducting vulnerability scans, assessing findings, coordinating remediation, and validating treatment outcomes.
\n
• Data Analytics & Reporting: Strong proficiency in Power BI, advanced Excel, Power Query, data analysis, pivot tables, and the development of management reporting and dashboards.
\n
• Automation & Scripting: Experience with scripting and an ability to apply AI tools and automation techniques to streamline repetitive tasks and improve processes.
\n
• Infrastructure & Networking: Strong understanding of network devices and architecture, TCP/IP, network protocols, server operating systems, and vulnerability scanning technologies.
\n
• Operating Systems & Technologies: Familiarity with Windows, Linux/Unix, VMware, intrusion detection and prevention technologies (IDS/IPS), and digital forensic discovery concepts.
\n
• Security Frameworks & Controls: Knowledge of cybersecurity and IT audit frameworks and standards, including NIST Cybersecurity Framework (CSF), ISO 27001, CIS Controls, and FFIEC guidance.
\n
• Governance & Documentation: Understanding of internal controls, security policies, audit requirements, and the development and maintenance of procedures, process manuals, playbooks, and runbooks.
\n
• Communication & Collaboration: Strong analytical, interpersonal, and communication skills, with the ability to present technical findings and recommendations to management and collaborate effectively across geographically distributed teams.
\n

\n

Education & Preferred Certifications

\n

\n
• Bachelor's degree in Information Assurance, Information Security, Computer Science, or a related field, or equivalent professional experience.
\n

\n

Relevant certifications are preferred but not required, including:

\n

\n
• CISSP – Certified Information Systems Security Professional
\n
• CISM – Certified Information Security Manager
\n
• GCIH – GIAC Certified Incident Handler
\n
• GCIA – GIAC Certified Intrusion Analyst
\n
• GPEN – GIAC Penetration Tester
\n