Vulnerability Analyst

Vulnerability Analyst

Location: Fairfax, VA (100% on-site)

Employment Type: Full-time, permanent

Status: Immediate start

Signal Hill Technologies is seeking an experienced Vulnerability Analyst to support our federal client's vulnerability management program. This role is responsible for identifying, assessing, and reporting on vulnerabilities across enterprise systems, networks, and applications, and for driving remediation efforts in coordination with system owners and cyber defenders. This role is based on-site in Fairfax, VA five days a week

Position Responsibilities

• Perform technical and non-technical risk and vulnerability assessments across the local computing environment, network and infrastructure, enclave boundary, supporting infrastructure, and applications.
• Conduct recurring and ad-hoc vulnerability scans using Tenable Nessus (Nessus Professional, Tenable.sc, and/or Tenable.io), and analyze results to identify, prioritize, and track findings through remediation.
• Prepare audit and assessment reports identifying technical and procedural findings, with clear, actionable remediation and mitigation recommendations for system owners and leadership.
• Serve as the primary point of contact for system owners, walking them through scan results and advising on remediation priorities.
• Analyze the organization's cyber defense policies and configurations and evaluate compliance with applicable regulations, directives, and enclave/local policy.
• Maintain and operate cyber defense audit tools (scanning software/hardware) in support of assessments.
• Maintain current knowledge of applicable cyber defense policies, regulations, and compliance frameworks relevant to vulnerability assessment and auditing (e.g., NIST RMF, DISA STIGs).
• Measure the effectiveness of defense-in-depth architecture against known and emerging vulnerabilities.
• Track vulnerability trends and metrics over time, and brief technical and non-technical stakeholders (including leadership) on posture, risk, and compliance status.
• Coordinate with system/application owners, ISSOs/ISSMs, and engineering teams to validate findings and support timely remediation.
• Support the development and refinement of vulnerability management processes, scanning schedules, and reporting standards.

Minimum Qualifications

• Public Trust eligible (U.S. citizenship or green card required and ability to pass a background investigation; no active clearance required).
• Hands-on, in-depth experience with Tenable products, including Tenable Nessus Professional.
• 2+ years of experience conducting network, system, or application vulnerability assessments.
• Strong collaborative and interpersonal skills, with a customer-service mindset, and the ability to clearly communicate technical findings and actionable guidance in a diplomatic and approachable manner.
• Working knowledge of network security architecture (topology, protocols, defense-in-depth) and traffic flows across TCP/IP and OSI layers.
• Experience with operating system hardening standards, such as CIS or DISA STIGs.
• Ability to analyze scan output, correlate findings, and produce clear written reports for both technical and executive audiences.

Preferred Qualifications

• Direct experience supporting a federal civilian agency vulnerability management program.
• Experience working with legacy operating systems and Linux.
• Experience developing or delivering vulnerability management training or documentation for technical staff.
• Certifications: e.g., Security+ CE, CySA+, GSEC or equivalent.
• Knowledge of the MITRE ATT&CK framework.

Benefits

• Compensation: $110k-$135k depending on experience
• Company health plan
• 401(k) plan with employer match
• Paid holidays and paid time off
• Education reimbursement

----------------

How to Apply

Submit a detailed resume (including complete work history with month/year for each role and all certifications) directly through LinkedIn. Please account for any gaps in employment and specify all relevant training and degrees with the year and month earned.

About Signal Hill Technologies

Founded and led by veteran cyber operators, Signal Hill Technologies delivers advanced cybersecurity solutions to federal civilian, DoD, Intelligence Community, financial services, and critical infrastructure clients, with many years of experience defending both U.S. Government and commercial clients against sophisticated, well-funded, motivated adversaries. We are relentless about real results and operationally proven expertise. Our mission is to provide the best technical solutions and hands-on support to address each customer's unique cyber risks.

Signal Hill Technologies is an equal opportunity employer. We do not discriminate based on race, color, religion, sex, national origin, age, disability, protected veteran status, or any other characteristic protected by applicable law.