Vulnerability Patch Management Analyst

A client of ours has a need for a Vulnerability Patch Management Analyst for their Midtown Manhattan office in NYC. This position is a contract hybrid role with 3 days a week in the office.

ONLY W2, must be a US citizen or GC Holder. NO vendors.

Key Responsibilities

Vulnerability & Patch Management

• Manage the end-to-end vulnerability and patch management lifecycle, including identification, assessment, prioritization, remediation, and validation across infrastructure, applications, systems, network devices, and the software development lifecycle (SDLC).
• Develop and implement risk-based remediation strategies that align vulnerability severity, business impact, and established remediation SLAs.
• Monitor remediation progress, identify SLA breaches, maintain Plans of Action and Milestones (POA&Ms), and drive follow-up actions with responsible IT teams.
• Coordinate with IT teams to obtain, test, and deploy vendor patches and security updates in a timely manner.
• Assess vulnerability exposure and treatment options to ensure remediation efforts are focused on the most critical risks.
• Develop, maintain, and enhance VPM policies, procedures, process documentation, playbooks, and runbooks.
• Establish and maintain a comprehensive patch management strategy, strengthening governance, accountability, and operational effectiveness.

Cybersecurity Monitoring & Incident Response

• Analyze security event data, SIEM alerts, and other relevant data sources to identify indicators of attack, suspicious activity, and potential security breaches.
• Produce incident reports, support incident coordination, and collaborate with cybersecurity defense teams to facilitate timely investigation and response.
• Coordinate with defense teams to ensure security monitoring tools and systems remain operational, current, and effective.
• Provide backup support for cybersecurity incidents, projects, and audit remediation activities, including off-hours support when required.

Risk, Governance & Compliance

• Evaluate vulnerability and patch management effectiveness, ensuring alignment with internal policies, security standards, regulatory expectations, and industry best practices.
• Collaborate with the Second Line of Defense (2LOD), IT Risk, Compliance, and internal and external auditors to support control assessments, audit requests, and remediation activities.
• Support vulnerability assessments, track system and software updates, and strengthen adherence to approved security tools and processes.
• Stay informed of emerging threats, industry trends, and evolving cybersecurity requirements to recommend continuous program improvements.

Reporting, Analytics & Program Enhancement

• Develop, maintain, and present key performance indicators (KPIs), key risk indicators (KRIs), dashboards, and management reports that provide clear visibility into vulnerability exposure, remediation progress, SLA performance, and program effectiveness.
• Deliver accurate, consistent, and actionable reporting to senior management, technology stakeholders, and cybersecurity leadership.
• Use data analytics, advanced Excel, Power Query, Power BI, scripting, and AI-enabled automation to streamline manual processes, improve data quality, and enhance operational efficiency.
• Translate complex technical findings into clear, actionable insights and strategic recommendations for stakeholders.
• Lead initiatives to improve the Americas CIB Vulnerability & Patch Management program through enhanced processes, reporting, automation, and risk-based decision-making.

Required Qualifications & Technical Skills

• Experience: 5–9 years of relevant experience in vulnerability management, patch management, cybersecurity operations, IT risk, or a related information security role.
• Vulnerability & Patch Management: Demonstrated experience managing vulnerability identification, scanning, risk assessment, remediation tracking, patch deployment, SLA monitoring, and POA&Ms.
• Security Monitoring: Hands-on experience with Security Information and Event Management (SIEM) tools, including alert analysis, dashboard development, and security reporting.
• Vulnerability Management Tools: Experience conducting vulnerability scans, assessing findings, coordinating remediation, and validating treatment outcomes.
• Data Analytics & Reporting: Strong proficiency in Power BI, advanced Excel, Power Query, data analysis, pivot tables, and the development of management reporting and dashboards.
• Automation & Scripting: Experience with scripting and an ability to apply AI tools and automation techniques to streamline repetitive tasks and improve processes.
• Infrastructure & Networking: Strong understanding of network devices and architecture, TCP/IP, network protocols, server operating systems, and vulnerability scanning technologies.
• Operating Systems & Technologies: Familiarity with Windows, Linux/Unix, VMware, intrusion detection and prevention technologies (IDS/IPS), and digital forensic discovery concepts.
• Security Frameworks & Controls: Knowledge of cybersecurity and IT audit frameworks and standards, including NIST Cybersecurity Framework (CSF), ISO 27001, CIS Controls, and FFIEC guidance.
• Governance & Documentation: Understanding of internal controls, security policies, audit requirements, and the development and maintenance of procedures, process manuals, playbooks, and runbooks.
• Communication & Collaboration: Strong analytical, interpersonal, and communication skills, with the ability to present technical findings and recommendations to management and collaborate effectively across geographically distributed teams.

Education & Preferred Certifications

• Bachelor's degree in Information Assurance, Information Security, Computer Science, or a related field, or equivalent professional experience.

Relevant certifications are preferred but not required, including:

• CISSP – Certified Information Systems Security Professional
• CISM – Certified Information Security Manager
• GCIH – GIAC Certified Incident Handler
• GCIA – GIAC Certified Intrusion Analyst
• GPEN – GIAC Penetration Tester