Vulnerability Analyst

Employment Type Full-time Signal Hill Technologies is seeking a highly skilled Vulnerability Analyst to support our federal client's vulnerability management program. The position is contingent upon contract award and is anticipated as full-time/permanent. This role is responsible for identifying, assessing, and reporting on vulnerabilities across enterprise systems, networks, and applications, and for driving remediation efforts in coordination with system owners and cyber defenders. This position is on-site in Fairfax, VA. About Signal Hill Technologies Founded and led by veteran cyber operators, Signal Hill Technologies delivers advanced cybersecurity solutions to DoD, Intelligence Community, financial services, and critical infrastructure clients, with many years of experience defending both US Government and commercial clients against sophisticated, well‑funded, motivated adversaries. We are relentless about real results and operationally proven expertise. Our mission is to provide the best technical solutions and hands‑on support to address each customer's unique cyber risks. Position Responsibilities Perform technical and non‑technical risk and vulnerability assessments across the local computing environment, network and infrastructure, enclave boundary, supporting infrastructure, and applications. Conduct recurring and ad‑hoc vulnerability scans using Tenable Nessus (Nessus Professional, Tenable.sc, and/or Tenable.io), and analyze results to identify, prioritize, and track findings through remediation. Prepare audit and assessment reports identifying technical and procedural findings, with clear, actionable remediation and mitigation recommendations for system owners and leadership. Serve as the primary point of contact for system owners, walking them through scan results and advising on remediation priorities. Analyze the organization's cyber defense policies and configurations and evaluate compliance with applicable regulations, directives, and enclave/local policy. Maintain and operate a deployable cyber defense audit toolkit (scanning software/hardware) in support of assessment missions. Maintain current knowledge of applicable cyber defense policies, regulations, and compliance frameworks relevant to vulnerability assessment and auditing (e.g., NIST RMF, DISA STIGs). Measure the effectiveness of defense‑in‑depth architecture against known and emerging vulnerabilities. Track vulnerability trends and metrics over time, and brief technical and non‑technical stakeholders (including leadership) on posture, risk, and compliance status. Coordinate with system/application owners, ISSOs/ISSMs, and engineering teams to validate findings and support timely remediation. Support the development and refinement of vulnerability management processes, scanning schedules, and reporting standards. Minimum Qualifications Bachelor’s degree in Computer Science, Cybersecurity, Information Systems, or a related technical field. Public Trust eligible (U.S. citizenship or green card required and ability to pass a background investigation). 2+ years of experience conducting network, system, or application vulnerability assessments. Strong collaborative and interpersonal skills, with a customer‑service mindset, and the ability to clearly communicate technical findings and actionable guidance in a diplomatic and approachable manner. Hands‑on, in‑depth experience with Tenable products including Tenable Nessus Professional. Working knowledge of network security architecture (topology, protocols, defense‑in‑depth) and traffic flows across TCP/IP and OSI layers. Experience with operating system hardening standards, such as CIS or DISA STIGS. Ability to analyze scan output, correlate findings, and produce clear written reports for both technical and executive audiences. Proficiency with Microsoft Office Suite and SharePoint for documentation and collaboration. Preferred Qualifications Direct experience supporting a federal civilian agency vulnerability management program. Experience working with legacy operating systems and Linux. Experience developing or delivering vulnerability management training or documentation for technical staff. Certifications: e.g. Security+ CE, CySA+, GSEC or equivalent. Knowledge of the MITRE ATT&CK framework. Compensation: $100k-$130k depending on experience. Company health plan. 401(k) plan with employer match. Paid holidays and paid time off. Signal Hill Technologies is an equal opportunity employer. We do not discriminate based on race, color, religion, sex, national origin, age, disability, protected veteran status, or any other characteristic protected by applicable law. #J-18808-Ljbffr Signal Hill Technologies