ResponsibilitiesSecurity and Vulnerability Management Engineer- Location: Washington, DC - on site Monday, Tuesday, and Wednesday, with up to two remote days per week
- Suitability: Must be able to obtain and maintain a Tier 2 Public Trust security clearance
- Travel: Periodic local travel to an alternate computing facility in the DC metro area
- Engagement for this assigned work: Full-time position, approximately 9 months (November 2026 - July 2027).
Responsibilities- Conduct authenticated and unauthenticated vulnerability assessments across servers, endpoints, network devices, Microsoft SQL Server instances, VDI, and AWS and Azure cloud workloads, delivering validated findings with reproducible steps and supporting evidence.
- Build and maintain a risk-based prioritization matrix using CVSS severity, asset criticality, and real-world exploitability mapping, with supporting asset inventory and scan coverage records.
- Optimize the Nessus scanning program: tune scan policies, resolve credentialed-scan failures, refine scheduling, and close coverage gaps across on-premises, cloud, and VDI environments.
- Correlate findings against Microsoft Sentinel and Varonis, with Splunk secondarily, to validate results and systematically suppress false positives.
- Stand up and run the remediation governance framework: ownership and accountability model, risk-based prioritization, SLA targets, closure standards, and escalation workflows. An initial Governance and Process Improvement Plan is due within 60 days of start.
- Drive the vulnerability backlog reduction initiative: analyze root causes of deferred findings, build targeted remediation plans, and track burn-down to closure.
- Coordinate remediation with system owners, validate and retest fixes, and document retest outcomes.
- Perform structured root cause analysis on recurring vulnerability patterns and implement corrective and preventive process and tooling improvements with named owners and target dates.
- Build dashboards and metrics for technical and executive audiences, including MTTR, aging, backlog burn-down, patch compliance percentage, and exception tracking.
- Design and improve endpoint patch deployment rings, maintenance windows, and automation using Microsoft Configuration Manager, Ivanti, and Jamf, and produce compliance metrics.
- Develop risk-based Windows and Linux server patching plans and workflows, submit and track formal change requests, validate results, and document rollback procedures.
- Support critical service continuity, including updates to business continuity and disaster recovery documentation as it relates to patching and critical systems.
- Review Check Point configurations to identify misconfigurations, overly permissive rules, and deprecated policy objects; implement hardened configurations through approved change management and produce validation documentation.
- Review and tune Microsoft Defender policies for Windows and macOS against NIST SP 800-53 Rev. 5, including Jamf-managed macOS device compliance, with pilot testing before enterprise rollout.
- Perform network-layer analysis across firewall rule sets, ACLs, NAT, DNS dependency chains, routing logic, and segmentation; review VPN, proxy filtering, and IPS/IDS configurations; troubleshoot identity and access paths.
- Conduct AWS and Azure cloud and network security posture reviews, including network segmentation and ZTNA gateway review.
- Review Entra ID and Active Directory Domain Services architecture, enhance Conditional Access policies, and assess PIM and MFA enforcement coverage and gaps.
- Support penetration testing and red team exercises, and produce formal Security Assessment Reports containing scope, findings, evidence, impact, recommendations, proof-of-concept reproduction steps, and retest results.
- Author runbooks, playbooks, SOPs, secure configuration references, change implementation documentation, and knowledge transfer documentation. Technical writing is a functional requirement of this role, not a secondary skill.
- Deliver weekly status reports covering tasks, blockers, risks, and after-hours work; monthly vulnerability management, endpoint patch compliance, and server patching and change request reports; security assessment reports following each assessment; and critical vulnerability notifications within the timeframe specified by the Customer.
- Perform after-hours work as needed for patching windows, assessments, policy changes, incident response, and critical vulnerability response.
- Travel periodically to the Customer's alternate computing facility in the DC metro area as directed. Local travel is not separately reimbursed.
QualificationsBasic Qualifications- Bachelor's degree and 8 years of relevant experience, master's degree and 6 years, or 12 years of experience in lieu of a degree.
- Minimum of 5 years of hands-on experience is required regardless of degree path.
- 5+ years of hands-on experience delivering enterprise-scale cybersecurity projects spanning vulnerability assessment, remediation planning, endpoint security, system hardening, and penetration testing.
- Demonstrated authenticated and unauthenticated vulnerability assessments producing validated, evidence-based findings.
- Strong working knowledge of NIST SP 800-53 Rev. 5, NIST RMF, defense-in-depth, Zero Trust, and IRS Publication 1075.
- Hands-on remediation and patching across Windows Server, Linux, and Microsoft SQL Server; AWS and Azure administration sufficient to perform cloud posture review.
- Check Point firewall and endpoint policy administration.
- Microsoft Defender policy administration for both Windows and MacOS.
- Proficiency with Nessus, Burp Suite, Nmap, and Kali Linux or equivalents.
- Network analysis across segmentation, firewall rules, DNS dependencies, routing logic, and cloud network configurations.
- IAM security experience including Conditional Access, PIM, and MFA enforcement.
- SIEM correlation using Microsoft Sentinel, Varonis, or equivalent.
- Scripting in Python, PowerShell, or C#.
- Patch tooling experience with Microsoft Configuration Manager, Ivanti, or Jamf.
- Enterprise virtualization and VDI experience.
- Formal change management experience building, submitting, and tracking change requests with validation and rollback planning.
- Ability to independently plan, execute, document, and validate technical deliverables to acceptance, with reproducible steps and retest results, without significant rework cycles.
- Ability to obtain and maintain Tier 2 Public Trust, including credit check, FBI criminal history check, and in-person fingerprinting at a designated federal facility in Washington, DC. Typical processing is 60 to 120 days.
- Willingness to complete IRS Publication 1075 Federal Tax Information training prior to system access if assigned to FTI-connected systems.
- Ability to work on site in Washington, DC Monday through Wednesday and support after-hours activity.
- Immediate availability; anticipated start on or about November 1, 2026.
- U.S. citizenship required.
- Must be able to obtain and maintain a Tier 2 Public Trust clearance.
Preferred Qualifications- Bachelor's degree in IT, Computer Science, Cybersecurity, or a related field.
- CISSP, CISM, GIAC, OSCP, CEH, Security+, AWS Certified Security - Specialty, or Microsoft security certifications such as AZ-500 Security Engineer Associate. All certifications are preferred; none are mandatory for this position.
- SOC operations, incident response, or red team experience.
- Social engineering and physical security testing experience.
- Vulnerability management metrics, dashboards, and executive risk reporting.
- Automation scripting, playbook development, and workflow integration.
- Zero Trust network architecture, NAC/ISE review, and IPS/IDS tuning.
- Remediation runbooks, secure configuration baselines, and hardening standards.
- Prior federal agency or IRS Publication 1075 environment experience.
- Located in the Washington, DC metropolitan area.
Target Salary Range$112,000 - $179,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual's experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.
