Vulnerability Management Engineer

C2C Rate: $80/Hr.- $85/Hr. on C2C Thanks.


Location: Hybrid / on-site 2 days a week in Auburn Hills, MI. Must be local or relo (out of pocket from day 1). No exceptions. NO West Coast candidates (PST) will be considered.


Duration: 10/15/24, should extend out long term


Interviews: Video

Other titles that could be used for this type of job include:

1. Vulnerability Management Specialist
2. Cybersecurity Operations Engineer
3. Security Compliance Engineer
4. Vulnerability Remediation Analyst
5. Threat and Vulnerability Management Engineer
6. Security Operations Analyst
7. Vulnerability Assessment Engineer
8. Cybersecurity Risk Analyst
9. Security Infrastructure Engineer
10. Vulnerability Mitigation Specialist

Required Skills and Experience (Must be outlined in the resume clearly in the job duties):

• Create policies in a vulnerability management product to align to customized internal standards
• Working knowledge of how to administer Windows, Linux, and UNIX operating systems
• Expertise with Qualys Policy Management , PCI compliance , and VMDR modules
• Experience with hardening systems from attacks
• Responsible for vulnerability scanning, prioritizing vulnerabilities, and driving remediations while partnering with the application and infrastructure teams.
• Hands-on expertise working in vulnerability management and operations
• Experience with tools such as Qualys, PowerBI, and/or SAST/DAST .
• Experienced working with cross-functional teams in vulnerability management and prioritization
• Have the ability to automate while using a programming language .

Summary/Basic Purpose: Provide a detailed overview of the position including its purpose and desired results. Describe leadership responsibility if a management position. Use paragraph form.


The Cyber Vulnerability Operations Team consists of both the Application Security (AppSec) teams and the Vulnerability Management Operations (VM Ops) teams. Together, the Vulnerability Operations team collaborates with peers across the organization to provide visibility into vulnerabilities within applications and infrastructure and ensures they are remediated, as well as facilitates and enforces the use of secure development practices across the bank.


The Cyber Vulnerability Operations Engineer role is

• Responsible for vulnerability scanning, prioritizing vulnerabilities, and driving remediations while partnering with the application and infrastructure teams.
• The ideal candidate for this role will have hands-on expertise working in vulnerability management and operations and will have knowledge of tools such as Qualys, PowerBI, and/or SAST/DAST.
• This candidate will be experienced working with cross-functional teams in vulnerability management and prioritization, and will have the ability to automate while using a programming language.

Essential Duties/Responsibilities: List the essential duties and responsibilities of the job. Each duty/responsibility should represent at least 10% of the job, totaling 100%, not to exceed 7 items.


Duties/Responsibilities:


% of Time Required:


Vulnerability Management Operations


Perform vulnerability assessments and common baseline control scans across the company environment and report on Key Risks Indicators (KRIs). Lead security vulnerabilities and risk management activities across the organization, including identifying vulnerabilities and supporting application/system owners to manage risks/remediate vulnerabilities. Establish and mature processes around vulnerability management, remediation, and reporting. Lead key projects such as vulnerability prioritization to remediate critical key vulnerabilities. Participate in vendor evaluations and selection for vulnerability management products, such as external attack surface management. Implement and support those products on a continuous basis. Stay current on vulnerability management best practices across the industry.


Administration & Reporting


Develop a comprehensive set of metrics to track on enterprise risks and remediation trends and keep Management informed of them through accurate, timely, and appropriate reporting. Support monthly KRI reporting through data collection, working with application and infrastructure teams to remediate vulnerabilities. Create presentations based off KRI materials and keep Management informed of them.


Technical Consulting & Communication


Drive technical excellence and implementation of vulnerability management best practices in collaboration with technology teams across the enterprise. Provide consultation to and work closely with other functional infrastructure areas/departments on multiple initiatives to meet common organizational/business goals and objectives. Collaborate with business units, application and infrastructure teams, and vendors to identify, review and evaluate solution requirements. Automate existing manual processes in order to create improved processes and create faster delivery. Coach and mentor more junior team members and application teams on vulnerability remediation efforts.


Risk Management


Identify and communicate gaps in our vulnerability management practices. Participate in Red Team exercises to identify potential vulnerabilities proactively. Partner with application and infrastructure owners to provide consulting on vulnerability remediation to allow them to appropriately remediate large highly complex vulnerabilities within the SLA (service level agreement) and reduce risk for the bank. Develop cyber vulnerability analysis for known vulnerabilities, as well as cyber-related metrics and reporting deliverables.