DFC - Vulnerability Management Analyst
Full-time
cFocus Software Incorporated
cFocus Software seeks a Vulnerability Management Analyst to join our program supporting the United States International Defense Finance Agency (DFC). This position is remote. This position requires an Active Public Trust clearance.
Qualifications:
Qualifications:
- Active Public Trust clearance
- B.S. Computer Science, Information Technology, or a related field
- 5+ years of cybersecurity experience, including three or more years in vulnerability management, security compliance, POA&M management, or a closely related function.
- Hands-on experience analyzing authenticated scan results and validating vulnerabilities using Tenable Nessus, Qualys, Microsoft Defender, or comparable enterprise platforms.
- Demonstrated ability to assess vulnerability risk using CVSS, exploitability, CISA KEV status, asset criticality, exposure, mission impact, threat intelligence, and compensating controls.
- Experience creating and maintaining POA&M records, tracking remediation milestones, reconciling GRC and ticketing systems, validating closure evidence, and documenting false-positive determinations.
- Working knowledge of FISMA, the NIST Risk Management Framework, NIST SP 800-53 controls, NIST SP 800-40 vulnerability and patch-management principles, CISA KEV/BOD 22-01 requirements, and federal continuous-monitoring expectations.
- Ability to communicate technical risk clearly to federal cybersecurity leaders, System Owners, engineers, administrators, auditors, and nontechnical stakeholders.
- Strong analytical writing, data-quality, documentation, prioritization, and time-management skills in a deadline-driven environment.
- Active Security+, CySA+, CEH, GCVA, CISSP or other relevant security certifications preferred.
- Coordinate authenticated vulnerability scans with DFC stakeholders at frequencies aligned with policy, system criticality, exposure, threat conditions, and Government direction.
- Analyze output from Tenable, Qualys, Microsoft Defender, and other Government-approved vulnerability, endpoint, configuration, and posture-management platforms.
- Validate scanner findings against the operational environment and distinguish valid findings from false positives using documented rationale and supporting evidence.
- Assess and assign severity using CVSS, DFC policy, exploitability, known-exploitation status, asset criticality, external exposure, mission impact, and relevant threat intelligence.
- Recommend risk-informed remediation priorities, actions, timelines, evidence requirements, and closure criteria.
- Coordinate with engineering, operations, application, cloud, endpoint, and system administration teams to establish remediation ownership, dependencies, and target completion dates
- Provide rapid analysis and coordination for CISA Known Exploited Vulnerabilities (KEV), Binding Operational Directive 22-01 requirements, CISA Emergency Directives, vendor-declared zero-days, and vulnerabilities with active exploitation.
- Notify the ISSM within four hours of applicable CISA notification, vendor disclosure, Government notification, or Contractor identification.
- Verify exposure across applicable CSAM authorization boundaries and deliver a written impact assessment within one business day.
- Document affected systems, boundaries and assets; severity; exposure; exploitability; known exploitation; mission impact; remediation ownership; required timelines; recommended action; and residual-risk considerations.
- Track emergency remediation against CISA-, DFC-, or Government-directed deadlines and provide written confirmation of remediation status, compliance status, residual risk, and closure evidence.
- Use CSAM as the authoritative POA&M and compliance ledger and ServiceNow as the operational remediation ticketing record.
- Create complete POA&M items in CSAM within three business days after finding identification or Government direction, unless the Government establishes another deadline.
- Populate and maintain required fields, including identifier, weakness description, affected system and control, severity, source, responsible owner, required resources, scheduled completion date, milestones, status, residual risk, and closure evidence.
- Maintain bidirectional traceability so each applicable ServiceNow remediation ticket links to its CSAM POA&M item and each CSAM POA&M record references the appropriate ServiceNow ticket.
- Track remediation through closure, monitor milestone integrity and aging, and coordinate scheduled-completion-date changes only after federal authorization.
- Conduct monthly ServiceNow-to-CSAM reconciliation; identify stale or duplicate records, missing links or evidence, inconsistent status, inaccurate dates, and other data-quality issues; issue a written discrepancy log and track gaps to resolution.
- Prepare risk-acceptance or exception recommendation packages when remediation cannot be completed within applicable timelines or scheduled-completion-date constraints.
- Document the affected system and weakness, operational and mission impacts, exploitability, exposure, residual risk, compensating controls, remediation constraints, proposed duration and expiration, review interval, and conditions for continued acceptance.
- Route recommendation packages to the AODR through the COR and ISSM for federal decision and accurately record approved decisions in CSAM.
- Clearly preserve federal authority: do not accept risk for DFC, approve exceptions, extend POA&M dates without authorization, or make final closure decisions.
Vacancy posted 16 days ago
Similar jobs that could be interesting for youBased on the DFC - Vulnerability Management Analyst in Washington DC vacancy
$87.1k - $157.45k
...Leidos has a career opportunity for a Vulnerability Management Analyst to support the Air Force National Capital Region IT Services program. The AFNCR IT Services program provides support services for information systems for Headquarters Air Force (HAF), Air Force District...SuggestedWork at officeWorldwideComfort Systems USA
District Heights, MD5 days ago$87.1k - $157.45k
...Description Leidos has a career opportunity for a Vulnerability Management Analyst to support the Air Force National Capital Region IT Services program. The AFNCR IT Services program provides support services for information systems for Headquarters Air Force...SuggestedWork at officeLocal areaImmediate startWorldwideLeidos
Suitland, MD4 days ago$110k - $130k
...produce meaningful results. This is a contingent position based on contract win. SkyePoint Decisions is seeking a Vulnerability Management Analyst to support a cybersecurity program by identifying, analyzing, tracking, and reporting security vulnerabilities across...SuggestedContract workRemote work- DescriptionSAIC is seeking a highly skilled Senior Vulnerability Analyst with a strong technical background to join our team in support of a... ...to work with a team responsible for Patch and Vulnerability Management, contributing to the security and integrity of vital...Suggested2 days per week
- ...S. Government customer to provide cybersecurity vulnerability analysis support to reduce the prevalence and impact... ...(CIKR). The Cybersecurity Vulnerability Analyst utilizes cybersecurity best practices, risk management techniques, critical thinking, and strong analytical...Suggested
$104k - $166k
ResponsibilitiesPeraton is currently seeking a Senior Risk and Vulnerability Analyst.Location: Chandler, AZ or Washington DCRole and... ...years of experience in security operations, vulnerability management, or risk analysis. 6 years of experience with a Masters Degree...Contract workShift work- ...upon contract award ***Overview SOSi is seeking a Risk and Vulnerability Analyst II to support vulnerability assessment and risk analysis activities... ...to support tool operations, testing, and vulnerability management activitiesQualifications· Experience:Three (3) to five (5)...Contract workWork at officeWorldwideMonday to FridayWeekend workAfternoon shift
- ...Phoenix Cyber is looking for Vulnerability Analysts to join our client delivery team. This is a remote position. Provide technical leadership and oversight to vulnerability threat management activities and initiatives Develop and implement strategies to manage and...Full timeRemote work
- One Federal Solution is seeking an experienced Operations Management Analyst to support a Government Client by providing analytical, operational, and program management support for mission-critical initiatives. The successful candidate will analyze operational data, evaluate...
$99k - $144k
...service and not for profit, we measure our success in the impact of our service. Position Overview ANSER is seeking an Operations Management Analyst to support the Office of the Secretary of War (OSW), Director of Administration and Management (DA&M), Organizational and...Full timeContract workWork at officeLocal areaMonday to Friday- SummaryAll Native Group is seeking a Management and Program Analyst II position to provide skilled — and largely independent — administrative analytical and evaluative work to program operations and, management and organizational efficiency and productivity for the assigned...Full timeContract workFor contractorsWork at officeImmediate startOverseasMonday to FridayWeekend workAfternoon shift
$122.53k - $159.29k
...businesses, minority educational institutions, and historically under-represented communities.ResponsibilitiesAs a GS-14, Management and Program Analyst, you will:Conduct analyses energy use and costs paid by minority communities as well as measuring participation in the...Permanent employmentFull timeTemporary workWork experience placementWork at office- DescriptionManagement Analyst - TS/SCI with CI Poly Xcelerate Solutions is seeking an experienced, results oriented Management Analyst to join our team in the Bethesda, Maryland area. Responsible for conducting analysis of transition planning, intelligence information...
- ...subject matter expert in a specialized area. Formulates LOB/SO management policies and systems. Participates and provides direction to... ...intensity that they often require input and assistance from other analysts and subject-matter specialists in field appropriate to the...Full timePart timeFor contractors
$73.45k - $132.78k
Leidos has a new and exciting opportunity for a Journeyman Records Management Analyst in our Intel Sector Analysis Solutions Business Area (ASBA). Our talented team is at the forefront in Security Engineering, Computer Network Operations (CNO), Mission Software, Analytical...Full timeFor contractorsWork at officeImmediate startFlexible hours- KeyLogic is seeking a Management Analyst to join our growing team supporting the U.S. Department of Energy (DOE) National Energy Technology Laboratory (NETL). The Analyst will support the Federal Project Managers, Financial Analysts, and Administrators. This position requires...Work at officeFlexible hours
$122.53k - $159.29k
...timeServiceCompetitivePromotion potential None Job family (Series) 0343 Management And Program Analysis Supervisory statusYesSecurity... ...as grant manager will be the primary collector, organizer, and analyst of performance measurement data.Responsible for designing,...Permanent employmentFull timeTemporary workPart timeWork at officeLocal areaRemote workRelocationRelocation packageShift work- ...Salesforce case record creation Verify integrations between AI-generated summaries, call metadata, quality scores, and Verint quality management systems Validate CloudWatch alarms, anomaly detection configurations, operational monitoring dashboards, and alerting...Local area
rockITdata
Arlington, VA3 days ago $121.79k
Agency: Department of Homeland Security - Agency WideDepartment: Department of Homeland SecuritySalary: Starting at $121,785 Per year (GS 12-13)Dates: Open 05/13/2026 to 11/12/2026Schedule: Full-timeWork type: DetailRelocation: FalsePosition ID: JDP-12961528-26-DJDocument...$143.91k
...ACTIVITYSalary: Starting at $143,913 Per year (GG 14)Dates: Open 07/30/2026 to 08/10/2026Schedule: Full-timeWork type: PermanentRelocation: TruePosition ID: DE-13022371-26-KEKDocument ID: 878394400Grade: GG 14Job category: Management And Program Analysis (0343)Hiring path: public$122.53k - $159.29k
...Permanent Work schedule Full-time Duties SummaryThe ideal candidate for this position will be a senior expert-level analyst and advisor to management on the evaluation of the productivity and efficiency of managed work. This position starts at a salary of $122,530 (GS...Permanent employmentFull timeTemporary workPart timeWork at officeLocal areaRelocationOverseas$143.91k
...: Full-timeWork type: PermanentRelocation: FalsePosition ID: 26-13023560-HQ-AE-STDocument ID: 879087100Grade: GS 14Job category: Management And Program Analysis (0343)Hiring path: fed-competitive, fed-transition, land, vet, mspouse, disability, peace, special-authorities- ...You will be required to perform one or more of the following duties: Parking Management, Shuttle Service operations or Transportation Services Management. As a Management and Program Analyst GS 0343 12/13, your typical work assignments may include: Serve as an expert analyst...Permanent employmentFull timeContract workPart timeFor contractorsWork at officeRemote workFlexible hours
$98k - $163k
...support across pre‑award and post‑award processes to help ensure timelines are met, including:Responding to programmatic queries from management and program staff.Supporting grants management and grant program administration by collaborating with program specialists,...Full timeFlexible hours- Company DescriptionProSidian is a Management and Operations Consulting Services Firm focusing on providing value to clients through tailored... ...DescriptionProSidian Seeks a DOE - NNSA Management & Program Analyst - Program Management Support (TEPSIII06) headquartered near...Full timeTemporary workFor contractorsWork at officeRemote workFlexible hours
- Company DescriptionProSidian is a Management and Operations Consulting Services Firm focusing on providing value to clients through tailored... ...at DescriptionProSidian Seeks a Management and Program Analyst - Junior - Transition and Economic Development headquartered near...Full timeTemporary workFor contractorsWork at officeFlexible hours
$78.2k - $137.7k
...and customer information. GIS develops the bank’s Information Security strategy and policy, manages the Information Security program, identifies and addresses vulnerabilities and operates a global security operations center that monitors, detects and responds to cybersecurity...Full timeWork at officeDay shift- ...guidance to the leads of the Application and Data Coordination Working Group .Coordinates activities within the Electronic Records Management Working Group (ERMWG) to continue moving forward toward achieving the Office of Management and Budget/National Archives and...Full timePart timeWork at officeRemote work
$76.7k - $128k
...include annual revenues, employment, or expenditures. Interview managers and employees while observing their operations. Develop... ...regarding findings also are common. For some projects, management analysts are retained to help implement the suggestions they have madeQualificationsExperience...For contractors- ...The employee serves as a resource in the development and implementation of performance excellence management policies, tools and initiatives. Also, serves as a senior analyst and adviser on continuous improvement, quality, strategy, program, and project management...Permanent employmentFull timeTemporary workPart timeWork experience placementWork at officeLocal areaRemote workRelocation
Do you want to receive more vacancies?
Subscribe and receive similar vacancies to DFC - Vulnerability Management Analyst. Be the first to apply!
Related searches
- ethical hacker Washington DC
- vulnerability analyst Washington DC
- penetration tester Washington DC
- remote senior business analyst Washington DC
- senior business analyst Washington DC
- business strategy analyst Washington DC
- business analyst part time remote Washington DC
- engineering business analyst Washington DC
- capital markets business analyst Washington DC
- entry level business analyst Washington DC