Vulnerability & Patch Management Analyst (HYBRID, NYC)

We're seeking a Cybersecurity/Vulnerability Analyst to manage the vulnerability and patch management lifecycle, including identifying vulnerabilities, prioritizing risk, and tracking remediation. This person will also develop security reporting and improve vulnerability management processes. This role requires 3-days onsite each week in Midtown, NYC. A growing financial services firm in NYC. Description We're seeking a Cybersecurity/Vulnerability Analyst to manage the vulnerability and patch management lifecycle, including identifying vulnerabilities, prioritizing risk, and tracking remediation. This person will also develop security reporting and improve vulnerability management processes. This role requires 3-days onsite each week in Midtown, NYC. Manage the full vulnerability and patch management lifecycle, including identification, prioritization, tracking, and remediation across infrastructure, systems, applications, and the SDLC. Analyze cybersecurity event data and other data sources for potential attack indicators and security breaches. Assess vulnerabilities to determine their potential impact and overall risk to systems and infrastructure. Prioritize patch deployments based on risk and manage SLA breaches, including developing and executing follow-up plans. Monitor vulnerability remediation efforts and ensure vulnerabilities are addressed in a timely manner. Conduct vulnerability scans and support vulnerability treatment and remediation activities. Develop and deliver vulnerability and patch management reporting for leadership and relevant technology teams. Develop and present key performance indicators (KPIs) and adapt key risk indicators (KRIs) to support a risk-based vulnerability management approach. Monitor the effectiveness of the patch management program and recommend improvements. Design, enhance, and maintain vulnerability and patch management procedures, processes, playbooks, and runbooks. Coordinate the development and ongoing maintenance of the organization's patch management strategy. Assist IT teams with acquiring and deploying vendor patches and software/system updates. Collaborate with IT and security stakeholders across the Americas and international teams. Work with Second Line of Defense teams and auditors as needed. Strengthen compliance with cybersecurity standards, security best practices, and approved tools. Support cybersecurity projects, security incidents, and audit remediation activities as needed. Ensure security monitoring systems remain online, current, and operational. Identify opportunities to use AI to automate manual cybersecurity processes and tasks. Provide off-hours support when needed to address emerging security threats. Profile Minimum of 5 years of experience in vulnerability management, patch management, cybersecurity, or a related security role. Experience overseeing Plans of Action and Milestones (POA&M). Strong understanding of common cybersecurity vulnerabilities and the ability to assess their impact on systems and infrastructure. Hands‑on experience with vulnerability management tools, including vulnerability scanning, treatment, and remediation. Experience working with SIEM tools, including building dashboards and reports. Strong experience with reporting and data analysis tools, including Power BI, advanced Excel, and Power Query. Experience working with datasets and pivot tables. Scripting experience. Experience creating and enhancing cybersecurity documentation, including procedures, playbooks, and runbooks. Deep understanding of network devices and architecture, TCP/IP, network protocols, server operating systems, and vulnerability scanning. Knowledge of Windows, Linux/Unix, VMware, IDS/IP, and forensic discovery. Strong understanding of internal controls and experience improving cybersecurity processes, procedures, and documentation. Knowledge of cybersecurity and IT audit frameworks and standards, including NIST, FFIEC, ISO 27001, NIST CSF, and CIS. Ability to create management‑level presentation materials and clearly communicate cybersecurity risks, findings, and recommendations. Strong communication and collaboration skills with the ability to work across multiple technical and business teams. Ability to use AI to automate manual processes and tasks. Bachelor's degree in Information Assurance, Information Security, Computer Science, a related field, and/or equivalent professional experience. CISSP, CISM, GCIH, GCIA, or GPEN certification is preferred but not required. Job Offer Access to Michael Page health benefits beginning day-1 of employment! MPI does not discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity or expression, national origin, age, disability, veteran status, marital status, or based on an individual's status in any group or class protected by applicable federal, state or local law. MPI encourages applications from minorities, women, the disabled, protected veterans and all other qualified applicants. #J-18808-Ljbffr Michael Page