Cyber Security Analyst II VM (Senior) - ECCOS

Job Description

Job Description

Pending Contract Award

Mission Objectives ? ECCOS provides Enterprise Vulnerability Management (EVM) support to Mission Delta 6. The two Cyber Security Analyst II VM (Senior) positions lead the EVM cell?s enterprise vulnerability identification, assessment, prioritization, remediation tracking, risk analysis, Service Level Agreement performance analysis, and leadership reporting activities.

The Senior EVM Analysts lead and provide technical direction to the Cyber Security Analyst I VM (Journeyman) personnel supporting scan review, vulnerability data analysis, Plans of Action and Milestones tracking, scorecard and Congressionally Mandated Report Submission data preparation, configuration-data management, and compliance-incident assessment. Together, the EVM team provides the visibility, prioritization, evidence, and risk-informed recommendations necessary for Mission Delta 6 leadership and subscribers to reduce enterprise cyber risk.

Position Responsibility Summary (by CLIN focus):

CLIN 0005 ? EVM Lead

• Serve as the Enterprise Vulnerability Management Lead and senior technical focal point for vulnerability assessment, prioritization, tracking, and mitigation coordination across Mission Delta 6 and its subscribers.
• Lead the identification, categorization, validation, prioritization, and mitigation tracking of vulnerabilities, security weaknesses, misconfigurations, compliance gaps, and related cybersecurity risks in accordance with PWS 3.3.
• Administer and analyze vulnerability information within the Government-provided Tenable repository, including review of data quality, scan coverage, asset information, scan results, vulnerability status, exception status, and remediation progress.
• Establish and maintain enterprise and subscriber-level prioritization lists using vulnerability severity, mission impact, exploitability, asset criticality, operational dependency, remediation status, aging, and other Government-directed risk factors.
• Coordinate with system owners, administrators, cybersecurity personnel, mission partners, and Government stakeholders to validate findings, clarify ownership, identify remediation dependencies, and track corrective actions through closure.
• Facilitate development, validation, quality review, and submission of Department of War Scorecard and Congressionally Mandated Report Submission data, ensuring that reported data is timely, accurate, traceable, and reconciled with authoritative Government sources.
• Develop and maintain vulnerability-management dashboards, trackers, data calls, reports, and executive briefings that communicate enterprise risk, remediation status, aging vulnerabilities, compliance trends, and decisions required.
• Lead technical reviews of vulnerability findings and provide risk-informed recommendations for remediation sequencing, compensating controls, escalation, risk acceptance, and mitigation planning.
• Provide technical direction, work prioritization, mentoring, and quality oversight for junior EVM analysts supporting scan review, data analysis, POA&M tracking, configuration-data management, compliance analysis, and reporting.
• Serve as the trained alternate for CLIN 0006, assuming responsibility for SLA performance monitoring, enterprise trend and risk analysis, and assessment/audit-finding tracking when required.
• Alternate: CLIN 0006

CLIN 0006 ? SLA Performance, Trend and Risk Analysis

• Serve as the Enterprise Vulnerability Management Lead and senior technical focal point for vulnerability assessment, prioritization, tracking, and mitigation coordination across Mission Delta 6 and its subscribers.
• Lead the identification, categorization, validation, prioritization, and mitigation tracking of vulnerabilities, security weaknesses, misconfigurations, compliance gaps, and related cybersecurity risks in accordance with PWS 3.3.
• Administer and analyze vulnerability information within the Government-provided Tenable repository, including review of data quality, scan coverage, asset information, scan results, vulnerability status, exception status, and remediation progress.
• Establish and maintain enterprise and subscriber-level prioritization lists using vulnerability severity, mission impact, exploitability, asset criticality, operational dependency, remediation status, aging, and other Government-directed risk factors.
• Coordinate with system owners, administrators, cybersecurity personnel, mission partners, and Government stakeholders to validate findings, clarify ownership, identify remediation dependencies, and track corrective actions through closure.
• Facilitate development, validation, quality review, and submission of Department of War Scorecard and Congressionally Mandated Report Submission data, ensuring that reported data is timely, accurate, traceable, and reconciled with authoritative Government sources.
• Develop and maintain vulnerability-management dashboards, trackers, data calls, reports, and executive briefings that communicate enterprise risk, remediation status, aging vulnerabilities, compliance trends, and decisions required.
• Lead technical reviews of vulnerability findings and provide risk-informed recommendations for remediation sequencing, compensating controls, escalation, risk acceptance, and mitigation planning.
• Provide technical direction, work prioritization, mentoring, and quality oversight for junior EVM analysts supporting scan review, data analysis, POA&M tracking, configuration-data management, compliance analysis, and reporting.
• Serve as the trained alternate for CLIN 0006, assuming responsibility for SLA performance monitoring, enterprise trend and risk analysis, and assessment/audit-finding tracking when required.
• Alternate: CLIN 0005