Vulnerability Management Analyst

Role Summary
A Vulnerability Management Analyst is responsible for supporting cybersecurity initiatives within critical infrastructure environments, specifically focusing on vulnerability identification, analysis, and remediation. This role involves managing vulnerability scans, ensuring compliance with regulatory standards, and collaborating with cross-functional teams to maintain the security posture of operational assets. The position requires a proactive approach to safeguarding infrastructure and maintaining documentation for audit purposes.

Responsibilities

• Conduct routine vulnerability scans using industry-standard tools such as Tenable, Tripwire IP360, and Qualys.
• Analyze and validate scan results to identify critical vulnerabilities, collaborating with system and application owners to prioritize remediation efforts.
• Track remediation activities, verify vulnerability closures through re-scanning, and document remediation progress.
• Partner with infrastructure and application teams to ensure timely patching, configuration compliance, and security baseline adherence.
• Support NERC CIP compliance efforts by maintaining accurate documentation, providing evidence, and generating compliance reports.
• Develop, maintain, and utilize metrics and dashboards to communicate vulnerability status and trends over time.
• Document asset inventories, systems, and rack elevations for NERC CIP-impacted sites.
• Travel to substations and critical sites across the service territory for physical assessments and documentation.
• Contribute to the continuous improvement of vulnerability management processes, procedures, and operational workflows.
• Assist in site assessments, physical verification, and updating documentation related to vulnerability management.

Qualifications

• Minimum of 2 years of experience in cybersecurity, IT operations, or vulnerability management.
• Hands-on experience with vulnerability scanning tools such as Tenable, IP360, and Qualys.
• Knowledge of patch management, risk-based remediation, and security best practices.
• Familiarity with NERC CIP standards and evidence requirements is preferred.
• Strong organizational and communication skills, capable of working independently and within teams.
• Ability and willingness to travel to substations and critical infrastructure sites within San Diego County.
• Proficiency in Excel, dashboard creation, and basic scripting is a plus.
• Relevant certifications such as CompTIA Security+, GSEC, CISA, CISSP, or NERC CIP training are desirable.

Publishing Pay Range: $68.00 – $73.00

This position is based in office and requires employee to work on-site.