Sr Cyber Security Analyst- Vulnerability Management

Position Purpose:
The Senior Cyber Security Analyst at the company will serve as a senior hands-on technical resource within Cyber Security Operations, with primary responsibility for enterprise Vulnerability Management and secondary responsibility for supporting Cyber Operations activities associated with mergers and acquisitions. This role is responsible for identifying, validating, prioritizing, tracking, and helping drive remediation of vulnerabilities across
the enterprise.
The Senior Cyber Security Analyst will work extensively with vulnerability and exposure management technologies such as Wiz, CrowdStrike, Rapid7, and Nagomi to improve visibility, prioritize risk, validate findings, and measure reduction of security exposure. The position will also provide hands-on technical support during mergers and acquisitions by assessing acquired environments, identifying vulnerabilities and cybersecurity gaps, onboarding assets into established security processes, validating remediation activities, and helping transition acquired environments into standard Cyber Operations practices.
The Senior Cyber Security Analyst will report directly to the Cyber Security Operations Manager and will receive technical direction and engineering guidance from the Cybersecurity Staff Engineer.
Key Responsibilities:
Serve as a senior hands-on technical resource for the enterprise Vulnerability Management program, supporting vulnerability identification, validation, prioritization, remediation, and closure.
Administer, maintain, optimize, and support Vulnerability Management and exposure management technologies, including Wiz, CrowdStrike, Rapid7, Nagomi, and related platforms.
Perform vulnerability assessments across enterprise technology environments, including servers, workstations, network devices, cloud-hosted assets, applications, and other technology assets.
Analyze and validate vulnerability findings to reduce false positives and ensure remediation efforts are focused on legitimate cybersecurity risk.
Prioritize vulnerabilities using risk-based factors such as vulnerability severity, known exploitation, internet accessibility, asset criticality, business impact, threat intelligence, exploitability, compensating controls, and exposure paths.
Identify and prioritize vulnerabilities associated with active exploitation, zero-day vulnerabilities, CISA Known Exploited Vulnerabilities, emerging threats, and other high-risk security conditions.
Coordinate with Infrastructure, Network, Cloud, Application, and other technology teams to drive vulnerability remediation activities through completion.
Track vulnerabilities throughout the full lifecycle, including identification, validation, remediation, mitigation, exception, risk acceptance, and closure.
Perform technical validation following remediation to confirm vulnerabilities and exposures have been successfully addressed.
Identify recurring vulnerabilities, systemic weaknesses, and remediation challenges and recommend technical or process improvements.
Develop and maintain Vulnerability Management procedures, standards, runbooks, dashboards, operational documentation, and reporting.
Support vulnerability exception and risk acceptance processes by providing technical analysis, exposure information, and compensating-control considerations.
Perform vulnerability trend analysis and identify areas of increasing enterprise risk or recurring exposure.
Serve as a primary hands-on technical resource for Nagomi, supporting integrations, exposure analysis, security control validation, and risk-based prioritization.
Correlate vulnerability data, asset context, threat intelligence, and control information within Nagomi to improve remediation prioritization and identify areas of security exposure.
Analyze Nagomi findings to identify control gaps, vulnerabilities, security configuration issues, and opportunities to reduce enterprise exposure.
Develop vulnerability and exposure metrics that demonstrate remediation progress, vulnerability aging, recurring risk, coverage, and measurable reduction of security exposure.
Serve as a hands-on Cyber Operations resource supporting mergers, acquisitions, and business integrations.
Execute assigned Cyber Operations activities during M&A discovery, assessment, onboarding, and integration efforts.
Perform technical security discovery and vulnerability assessments within acquired environments to identify cybersecurity risks, vulnerabilities, unmanaged assets, unsupported technologies, security configuration weaknesses, and technical debt.
Establish an initial vulnerability and exposure baseline for acquired environments.
Assist with onboarding acquired assets into enterprise Vulnerability Management and exposure management technologies and processes.
Perform vulnerability scans, technical assessments, validation activities, and follow-up testing required during acquisition integration.
Analyze M&A security findings and provide actionable remediation recommendations to the appropriate technology teams.
Validate patches, configuration changes, mitigations, and other corrective actions implemented during M&A remediation efforts.
Track assigned M&A cybersecurity findings and Cyber Operations activities through completion.
Work closely with Infrastructure, Network, Cloud, Application, Identity, GRC, and other technology teams to complete assigned cybersecurity integration activities.
Assist with transitioning acquired environments into established Vulnerability Management processes, remediation workflows, reporting standards, and Cyber Operations practices.
Support automation, API integrations, reporting, and workflow improvements that increase the efficiency and scalability of Vulnerability Management activities.
Direct Manager Direct Reports:
The Senior Cyber Security Engineer will report directly to the Cyber Security Operations Manager.
This role does not have any direct reports.
The Senior Cyber security Engineer will receive technical direction, eguidance, standards, and technical prioritization from the Cybersecurity Staff Analyst.
The position will work closely with Cyber Security Operations, Cyber Engineering, Infrastructure, Network, Cloud, Application, Identity, GRC, and other technology teams to drive vulnerability remediation and support M&A Cyber Operations activities.
Travel Requirements:
The Senior Cyber Security Engineer may be required to travel occasionally to support mergers and acquisitions, cybersecurity assessments, acquired-company integration activities, technical meetings, or other business requirements.
Travel may include visits to acquired organizations, branch locations, data centers, offices, or other company facilities as needed to support hands-on Cyber Operations activities.
Physical Requirements:
The Senior Cyber Security Engineer position involves working in a standard office environment, with duties requiring extended periods of sitting, standing, and computer use.
The role requires the ability to communicate effectively with technical teams, business partners, leadership, and other stakeholders both verbally and in written form.
Occasional travel may be necessary to attend meetings, assessments, site visits, or M&A integration activities.
The company is committed to the principles of the Americans with Disabilities Act (ADA) and will provide reasonable accommodations to enable individuals with disabilities to perform the essential functions of this role effectively. Candidates seeking accommodations are encouraged to reach out to our HR department to discuss how we can support your application and work environment needs.
Working Conditions:
The Senior Cyber Security Engineer role is designed to operate within a hybrid work environment, blending both in-office and remote work arrangements to support flexibility, collaboration, and productivity.
The position operates in a fast-paced Cyber Security Operations environment where priorities may shift based on vulnerability severity, emerging threats, active exploitation, business risk, mergers and acquisitions, and remediation requirements.
The role requires the ability to independently manage multiple technical priorities while maintaining strong communication and coordination with Cyber Security, IT, and business stakeholders.
The Senior Cyber Security Engineer is expected to work collaboratively with technical teams to drive measurable reduction in enterprise vulnerability exposure and support the secure integration of acquired environments.
Minimum Qualifications:
Bachelor’s degree in Cybersecurity, Information Security, Computer Science, Information Technology, Engineering, or a related technical field from an accredited institution, or equivalent combination of education and professional experience.
At least 5 years of progressive experience in Cybersecurity, Vulnerability Management, Security Engineering, Cyber Security Operations, or a related technical discipline.
Strong hands-on experience with enterprise Vulnerability Management technologies and processes.
Demonstrated experience using vulnerability or exposure management technologies such as Wiz, CrowdStrike, Rapid7, Nagomi, or comparable platforms.
Strong understanding of vulnerability identification, validation, prioriti