vulnerability assessment analyst

cFocus Software Incorporated

<div><h1 class="jobSectionHeader">Vulnerability Analyst II &ndash; Job Description</h1>
Position Title: Vulnerability Analyst II 
Program: SBA Enterprise Cybersecurity Services (ECS)<h2 class="jobSectionHeader">
Position Summary</h2>
The Vulnerability Analyst II provides cybersecurity risk, vulnerability management, and compliance support services in alignment with the SBA Enterprise Cybersecurity Services (ECS) RFQ Task Area 3.5.2. The position supports the SBA Risk Management Framework (RMF), FISMA compliance initiatives, Information System Continuous Monitoring (ISCM), vulnerability management, controls assessment activities, audit support, and continuous monitoring operations across enterprise systems and cloud environments. The analyst performs vulnerability assessments, supports POA&amp;M development, validates security controls, coordinates remediation efforts, and assists Information System Security Officers (ISSOs) and system owners with maintaining compliant and secure systems.<h2 class="jobSectionHeader">
Essential Duties and Responsibilities</h2><ul><li>
Perform enterprise vulnerability assessments and compliance scans using SBA-approved tools such as Tenable Security Center (SC), Nessus, and Microsoft TVM.</li><li>
Review identified vulnerabilities, assess impact and risk, and provide remediation recommendations for operating systems, applications, network devices, and cloud environments.</li><li>
Support continuous monitoring and Risk Management Framework (RMF) activities in accordance with NIST SP 800-37, NIST SP 800-53 Rev. 5, and NIST SP 800-53A.</li><li>
Assist with the creation, maintenance, and review of cybersecurity documentation including System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&amp;Ms), Configuration Management Plans (CMPs), and contingency documentation.</li><li>
Support control assessments and validation activities by documenting NIST 800-53A Determine If Statements (DISs) and mapping vulnerabilities to applicable controls.</li><li>
Conduct vulnerability scanning activities every 72 hours across workstations, servers, routers, switches, and cloud-based assets in accordance with SBA requirements.</li><li>
Monitor CISA Known Exploited Vulnerabilities (KEV) listings and Binding Operational Directives (BODs) to identify and report emerging risks.</li><li>
Track zero-day vulnerabilities, coordinate remediation activities, and provide ad hoc reporting to leadership and stakeholders.</li><li>
Generate weekly vulnerability reports, dashboards, and briefing materials for ISSOs, system owners, and management.</li><li>
Assist with audit preparation and support activities involving IG, GAO, internal auditors, and external assessors.</li><li>
Maintain scanning infrastructure including scanner deployment, configuration, plugin updates, scan repositories, and vulnerability management SOPs.</li><li>
Support FedRAMP Continuous Monitoring (CONMON) activities by reviewing vulnerability reports and assessing vendor remediation activities.</li><li>
Participate in change management, security operations meetings, and enterprise cybersecurity coordination activities.</li><li>
Ensure all deliverables are complete, accurate, aligned with agency templates, and delivered within required timeframes.</li></ul><h2 class="jobSectionHeader">
Minimum Qualifications</h2><ul><li>
Bachelor&rsquo;s degree in Cybersecurity, Information Technology, Computer Science, Information Assurance, or related discipline. Additional years of experience may substitute for degree requirements.</li><li>
3&ndash;6 years of experience supporting vulnerability management, cybersecurity compliance, RMF, or information assurance activities in a federal environment.</li><li>
Experience performing vulnerability assessments and remediation activities using Tenable SC/Nessus or equivalent tools.</li><li>
Knowledge of FISMA, NIST RMF, NIST SP 800-53 Rev. 5, NIST SP 800-53A, NIST SP 800-137, and related federal cybersecurity standards.</li><li>
Experience supporting POA&amp;M management, security assessments, continuous monitoring, and audit response activities.</li><li>
Working knowledge of Windows, Linux/Unix, network infrastructure, cloud platforms, and enterprise security technologies.</li><li>
Strong written and verbal communication skills with the ability to produce technical documentation and executive-level reports.</li><li>
Ability to analyze security findings, prioritize risks, and coordinate remediation with technical stakeholders.</li></ul><h2 class="jobSectionHeader">
Preferred Certifications</h2><ul><li>
CompTIA Security+</li><li>
Certified Information Systems Security Professional (CISSP)</li><li>
Certified Ethical Hacker (CEH)</li><li>
GIAC Security Certifications (GSEC, GPEN, or similar)</li><li>
Tenable Certified Professional or equivalent vulnerability management certification</li></ul>
Gupkg0JOaj</div>

SBA - Vulnerability Analyst II

Core One

<div>Join our team at Core One! Our mission is to be at the forefront of devising analytical, operational and technical solutions to our Nation's most complex national security challenges. In order to achieve our mission, Core One values people first! We are committed to recruiting, nurturing, and retaining top talent! We offer a competitive total compensation package that sets us apart from our competition. Core One is a team-oriented, dynamic, and growing company that values exceptional performance!

We are seeking experienced Assessment Analyst to support Theater Security Cooperation (TSC) planning, analysis, and reporting efforts in support of USCENTCOM and higher headquarters. This role requires strong analytical expertise, operational planning experiencse, and the ability to contribute to complex, multi-level defense assessments in a dynamic operational environment.
<h2 class="jobSectionHeader">
Responsibilities</h2>
<ul><li>Support the collection, analysis, and reporting of periodic assessments for USCENTCOM and higher headquarters.</li>
<li>Develop and present assessment findings to senior leaders and key stakeholder forums.</li>
<li>Contribute to readiness reporting, campaign assessments, and strategic evaluation efforts.</li>
<li>Serve as a lead or supporting analyst for selected campaign plan assessments and related activities.</li>
<li>Coordinate with internal staff and external partners to consolidate data and produce integrated assessment products.</li>
<li>Participate in planning efforts, working groups, and operational planning teams supporting Security Cooperation initiatives.</li>
<li>Assist in the planning and execution of major Security Cooperation events and engagements.</li>
<li>Provide analytical and subject matter expertise to support Security Cooperation planning, strategy development, and decision-making.</li>
<li>Support the use and implementation of assessment tools and systems, including participation in working groups and process improvements.</li>
<li>Provide flexible, responsive support to emerging requirements and evolving mission priorities.</li>
</ul><h2 class="jobSectionHeader">Qualifications</h2>
<ul><li>Active TS/SCI clearance.</li>
<li>Bachelor's degree from an accredited college or university (or equivalent experience).</li>
<li>Minimum 10 years of relevant experience in defense analysis, planning, or related functional areas.</li>
<li>Demonstrated knowledge of DoD missions, organizations, and processes.</li>
<li>Experience working as a senior-level contributor on multidisciplinary teams.</li>
<li>Proven ability to collect, analyze, and present complex data in support of operational and strategic assessments.</li>
<li>Strong written and verbal communication skills, including experience briefing senior leadership.</li>
</ul><h2 class="jobSectionHeader">Desired Qualifications</h2>
<ul><li>Certification in Security Cooperation Planning, Oversight, and Execution Management (Basic or Intermediate).</li>
<li>Prior experience supporting Combatant Command (CCMD) or USCENTCOM operations.</li>
<li>Familiarity with DRRS, CCP, and joint planning and assessment processes.</li>
<li>Experience supporting interagency coordination and multinational engagements.</li>
<li>Knowledge of Security Cooperation planning, programming, and assessment systems (e.g., Socium).</li>
</ul>
Core One is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, gender identity, sexual orientation, national origin, or protected veteran status and will not be discriminated against on the basis of disability.</div>

Assessments Analyst

Deloitte

<div>Our Deloitte Cyber team understands the unique challenges and opportunities businesses face in cybersecurity. Join our team to deliver powerful solutions to help our clients navigate the ever-changing threat landscape. Through powerful solutions and managed services that simplify complexity, we enable our clients to operate with resilience, grow with confidence, and proactively manage to secure success. 
 
Work You'll Do 
<ul><li>
Application Security: Evaluate, enhance, and document secure software development practices. Lead AppSec assessments, support remediation efforts, and help set security requirements for platforms and custom applications.
</li><li>Compliance &amp; RMF (NIST): Provide deep support for federal compliance initiatives, specializing in NIST 800-53 and RMF processes. Develop control implementation plans, assist with artifacts, advise on audit readiness and manage POAMs
</li><li>DevSecOps (Cloud Security): Guide secure DevOps practices, integrating security into CI/CD pipelines and cloud architectures. Partner with teams to implement security automation and validate environments (AWS,).
</li><li>Vulnerability Assessment &amp; VAT Management: Conduct and coordinate vulnerability scans using Tenable, Inspector, or similar tools. Drive VAT resolution by engaging stakeholders, tracking remediation, and closing findings.
</li><li>Technical Project Delivery: Take charge of critical projects-organizing tasks, managing deadlines, and ensuring results. Handle ad-hoc assignments and maintain excellent documentation.
</li><li>Consulting: Communicate solutions and risks to technical and non-technical stakeholders. Lead and support ISSO activities, compliance reviews, and team enablement.</li></ul> 

The Team 
 
Deloitte's Government and Public Services (GPS) practice - our people, ideas, technology, and outcomes-are designed for impact. Serving federal, state, &amp; local government clients as well as public higher education institutions, our team of professionals brings fresh perspective to help clients anticipate disruption, reimagine the possible, and fulfill their mission promise. 
The Project Delivery Talent Model is designed for professionals with specialized skills that align to a current client need. Team members focus on delivering services to clients, without additional expectations related to business development or promotion. Their employment is tied to their role on a project, and they are eligible for a benefits package that is competitive for project delivery-focused professionals. 
 
Qualifications 
 
Required:
 
<ul><li>Bachelor's degree required.</li><li>
Must be legally authorized to work in the United States without the need for employer sponsorship, now or at any time in the future.</li><li>
Active Secret Clearance.</li><li>
Ability to work onsite up to two days a week onsite.</li><li>
3+ years in cloud security, security engineering, DevSecOps, or security automation, along with a strong understanding of cloud security fundamentals: IAM, network segmentation, encryption/KMS, secrets management, logging/monitoring, secure storage patterns.</li><li>
Security + certification or similar industry cert.</li><li>
2+ years' experience within the following:</li><li><ul><li>
At least one major cloud platform (AWS or Azure strongly preferred).</li><li>
Demonstrated automation capability:</li><li>
Proficiency in Python, PowerShell, or similar.</li><li>
Experience integrating APIs, automating workflows, and producing auditable outputs.</li><li>
Experience implementing security controls and/or compliance work in regulated environments (federal, healthcare, finance, etc.).</li><li>
Familiarity with Git-based workflows and CI/CD systems.</li></ul></li></ul> 
Information for applicants with a need for accommodation: https://www2.deloitte.com/us/en/pages/careers/articles/join-deloitte-assistance-for-disabled-applicants.html</div>

Cloud Security Engineer, Secret Cleared

Tikal Group Doha

Job Opportunity: Cybersecurity AnalystLocation: Doha, Qatar Company: Tikal Group DohaAbout UsTikal Group Doha is a technology solutions provider specializing in secure systems integration, IT infrastructure, and digital transformation. We are committed to protecting businesses against evolving cyber threats and ensuring the highest standards of data security. As we expand, we are seeking a skilled Cybersecurity Analyst to strengthen our security operations and safeguard our digital assets.Role OverviewThe Cybersecurity Analyst will be responsible for monitoring, analyzing, and responding to security incidents, ensuring compliance with regulatory standards, and proactively identifying vulnerabilities. This role requires technical expertise, analytical skills, and the ability to collaborate across teams to maintain a secure IT environment.Key Responsibilities<ul><li>Monitor and analyze security alerts, logs, and incidents.</li><li>Conduct vulnerability assessments and penetration testing.</li><li>Investigate and respond to cybersecurity threats and breaches.</li><li>Implement and maintain security tools, firewalls, and intrusion detection systems.</li><li>Ensure compliance with Qatari regulations and international cybersecurity standards.</li><li>Collaborate with IT teams to strengthen system defenses and patch vulnerabilities.</li><li>Prepare reports and recommendations for management on security posture.</li><li>Stay updated on emerging threats, trends, and best practices in cybersecurity.</li></ul>Qualifications<ul><li>Bachelor&rsquo;s degree in Cybersecurity, Information Technology, Computer Science, or related field.</li><li>2&ndash;5 years of experience in cybersecurity analysis or IT security.</li><li>Strong knowledge of security frameworks (ISO 27001, NIST, CIS).</li><li>Proficiency in SIEM tools, firewalls, and endpoint protection systems.</li><li>Experience with incident response, vulnerability management, and risk assessment.</li><li>Excellent problem-solving, analytical, and communication skills.</li><li>Ability to thrive in a fast-paced, multicultural environment.</li></ul>Why Join Us?<ul><li>Be part of a growing cybersecurity team in Doha.</li><li>Play a key role in protecting Tikal Group Doha&rsquo;s digital infrastructure.</li><li>Competitive salary and benefits package.</li><li>Opportunities for professional development and career advancement.</li><li>Supportive, innovation-driven, and security-focused work culture.</li></ul>Pay: Up to QAR35,000.00 per monthWork Location: In person

Cybersecurity Analyst

J5 Consulting

<div>J5 Consulting is a Maryland based company established in 2006 to provide computing and consulting services for government and commercial entities. Our services improve Information System networking performance and compliance and protect electronic assets from loss and compromise. We welcome your application to receive consideration for the following position.
Introduction:<div>
The Sponsor&rsquo;s organization provides technical services to other Sponsor organizations in the areas of: 
<ul><li>Desktop hardware to include workstations, printers, multi-function devices, monitors, desktop peripherals, large displays, webcams, and a variety of other hardware devices.</li><li>Voice to include networks, VoIP, analog, and digital implementations.</li><li>Audio and video to include desktop VTC, integrated audio and video conference room setups (cameras, speakers, A/V switches, control panels, etc.), and multi-VTC integrated room setups.</li></ul> 
The Contractor shall be required to provide Certification and Accreditation support to advise and assist the stakeholders with the Lifecycle Assessment and Authorization (A&amp;A) process, and develop a Systems Security Plan (SSP).</div> 
Required skills and demonstrated experience: 
<ul><li>
Bachelor&rsquo;s degree in management information systems, information assurance, computer engineering, or other closely related IT and cybersecurity discipline or equivalent work experience</li><li>
Demonstrated experience in the Risk Management Framework (RMF) methodology.</li><li>
Demonstrated experience managing document repositories and databases.</li><li>
Demonstrated experience in the use of process tracking and document control software</li><li>
Demonstrated experience with writing, communications, and briefing skills.</li><li>
Demonstrated experience with technical guidance and oversight both to technical and non-technical, senior level personnel.</li><li>
Demonstrated experience organizing, planning and prioritizing multiple tasks to complete work on schedule.</li><li>
Demonstrated experience in INFOSEC policies, regulations, and guidance&rsquo;s.</li><li>
Demonstrated experience with cyber risks such as malware, zero-day attacks, denial of service attacks, as well as associated mitigations regarding computer and network devices.
</li><li>Demonstrated pattern of excellent customer service skills and the ability to collaborate with customers at all levels.</li></ul>
Highly desired, though not required, include: 
<ul><li>
Demonstrated experience with the Sponsor&rsquo;s A&amp;A process.</li><li>
Certified Information Systems Security Professional (CISSP).</li><li>
Demonstrated knowledge of the Sponsor&rsquo;s standard project cycle.</li><li>
Demonstrated experience with the Sponsor&rsquo;s diverse information technology infrastructure, including operating systems, major application systems, and network architecture.</li></ul>
__________________________________________________________________________________
US Citizenship:<ul><li>
This position requires US Citizenship. Verification of US Citizenship to meet federal government security requirements will be confirmed.
</li></ul>Security Clearance:<ul><li>
The successful candidate must have an active U.S. Government Top Secret Security Clearance with a Full Scope Polygraph.</li><li>
Clearance Verification: This position requires successful verification of the stated security clearance to meet federal government customer requirements. You will be asked to provide clearance verification information prior to an offer of employment.</li></ul>
Travel:<ul><li>
 This position is expected to be onsite. The position will be located within the Washington Metropolitan Area (WMA). Local travel/POV will be on an as needed basis, within the local place of performance.</li></ul> 
Join J5 Consulting and Grow Your Cybersecurity Career
At J5, we&rsquo;re a team of innovators protecting organizations from evolving cyber threats. With 18+ years of success in government and commercial sectors, we offer meaningful opportunities to grow your career.
Enjoy comprehensive benefits, including:
<ul><li>100% employer-paid health coverage</li>
<li>a 6% 401(k) match</li>
<li>PTO</li>
<li>tuition reimbursement</li>
<li>bonuses</li>
<li>professional development, and more.</li>
</ul>
Ready to make an impact? Explore our open positions and apply today.
N2sEjICTxI</div>

Assessment & Authorization Specialist

NMC Health plc

<div>Actively monitor the networks, systems, applications, IT assets and bio-medical equipment&rsquo;s for suspicious activity and threats. Using offensive and defensive measures and information collected from a variety of sources to identify, analyze, and report events that occur or may occur within the network and make the initial decision on the event/ threat severity.</div>
 <div><ul><li>Manage network, intrusion detection and prevention systems.
</li><li>Conduct periodic compromise assessments across selected networks and propose recommendations based on assessment results.
</li><li>Conduct physical security assessment of the organization&rsquo;s systems, including servers and networks, ensuring that any unauthorized external physical interference is not actually possible.
</li><li>Conduct ongoing network hunt activities.
</li><li>Conduct proactive vulnerability assessment across the network, subnetworks and service traffic to identify potential points of intrusion.
</li><li>Research and develop methods of tracking and detecting malicious activity within a network.
</li><li>Develop tools, signatures, and methods of detection for use in incident response activities.
</li><li>Develop SIEM integrations, dashboards, and analytics to illuminate and visualize threat activity.
</li><li>Analyze network traffic to provide timely detection, identification, and alerting of possible attacks/intrusions, anomalous activities, and misuse activities and distinguish these incidents and events from benign activities.
</li><li>Uses data collected from a variety of cyber defense tools (e.g., anti-virus, IDS alerts, firewalls, network traffic logs) to analyze events that occur within their environments, perform cyber defense trend analysis and reporting, and perform event correlation to mitigate threats and gain situational awareness and determine the effectiveness of an observed attack.
</li><li>Carries out triage to ensure that a genuine security incident is occurring.
</li><li>Coordinate with entity-wide cyber defense staff to validate network alerts.
</li><li>Notify designated managers, cyber incident responders, and cybersecurity service provider team members of suspected cyber incidents and articulate the event&rsquo;s history, status, and potential impact for further action in accordance with the organization&rsquo;s cyber incident response plan.
</li><li>Document and escalate incidents (including event&rsquo;s history, status, and potential impact for further action) that may cause ongoing and immediate impact to the environment.
</li><li>Provide daily summary reports of network events and activity relevant to cyber defense practices.
</li><li>Analyze identified malicious activity to determine weaknesses exploited, exploitation methods, effects on system and information.
</li><li>Validate intrusion detection system (IDS) alerts against network traffic using packet analysis tools.
</li><li>Isolate and remove malware.
</li><li>Develop content for cyber defense tools use them for continual monitoring and analysis of network activity to identify malicious activity.
</li><li>Assist in the construction of signatures which can be implemented on cyber defense tools in response to new or observed threats within the network environment.
</li><li>Analyze and report organizational security posture trends.
</li><li>Monitor external data sources (e.g., cyber defense vendor sites, Computer Emergency Response Teams, Security Focus, Threat Intelligence Providers) to maintain updated of cyber defense threat condition and determine which security issues may have an impact on the enterprise.
</li><li>Provides cybersecurity recommendations based on significant threats and vulnerabilities.
</li><li>Provide advice and input for Disaster Recovery, Contingency, and Continuity of Operational Plans.
</li><li>Collect and analyze intrusion artifacts (e.g., source code, malware, and system configuration) and use discovered data to enable mitigation of potential cyber incidents within the enterprise.
</li><li>Use specialized equipment and techniques to catalog, document, extract, collect, package, and preserve digital evidence.
</li></ul>Utilize deployable forensics toolkit to support operations as necessary</div>
 <div>Knowledge
<ul><li>Security concepts such as cyber-attacks and techniques, threat vectors, risk and threat management, incident management etc.
</li><li>Networking concepts and protocols, and network security attacks, vulnerabilities, processes, methodologies, access control mechanisms, traffic analysis methods.
</li><li>Cyber threats and vulnerabilities and information dissemination sources (e.g., alerts and advisories).
</li><li>Cyber defense and vulnerability assessment tools and their capabilities.
</li><li>System and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).
</li><li>Scripting languages (e.g., Python, Perl, Bash) used in an incident response environment
</li><li>Incident response and handling methodologies.
</li><li>Intrusion Detection System (IDS)/Intrusion Prevention System (IPS) tools, applications, methodologies and techniques for detecting host and network-based intrusions.
</li><li>Threat investigations, reporting and investigative tools.
</li><li>Cyber defense and information security policies, procedures, and regulations.
</li><li>Common attack vectors, the different classes of attacks (e.g., passive, active, insider, close-in, distribution attacks) and attack stages (e.g., reconnaissance, scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks).
</li><li>Cyber attackers (e.g., script kiddies, insider threat, non-nation state sponsored, and nation sponsored), and attackers&rsquo; methodologies.
</li><li>Signature implementation impact for viruses, malware, and attacks.
</li><li>Windows/Unix ports and services.
</li><li>Relevant laws, legal authorities, restrictions, and regulations pertaining to cyber defense activities.
</li><li>Packet-level analysis using appropriate tools (e.g., Wireshark, tcpdump).
</li><li>Use of sub-netting tools.
</li><li>Penetration testing principles, tools, and techniques.
</li><li>Investigation, auditing and forensics methods, processes, procedures and standards.
</li><li>Different types of hardware, storage, imaging and file system analysis.
</li><li>Data backup and recovery.
</li></ul>Skills
<ul><li>Using SIEM/SOAR and Vulnerability Management tools and services.
</li><li>Sysadmin skills (Linux/Mac/Windows).
</li><li>Programming skills (Python, Ruby, PHP, C, C#, Java, Perl, and more).
</li><li>Identifying, analyzing and interpreting trends or patterns in complex data sets.
</li><li>Developing and deploying signatures.
</li><li>Detecting host and network-based intrusions via intrusion detection technologies (e.g., Snort).
</li><li>Using incident handling methodologies.
</li><li>Collecting data from a variety of cyber defense resources.
</li><li>Recognizing and categorizing types of vulnerabilities and associated attacks.
</li><li>Performing packet-level analysis.
</li><li>Conducting trend analysis.
</li><li>Using cyber defense reporting structure and processes.
</li><li>Utilizing a combination of automated and manual testing methods.
</li><li>Developing automated vulnerability testing scripts and using off the shelf vulnerability testing tools.
</li><li>Conducting vulnerability scans and recognizing vulnerabilities in networks, systems and applications.
</li><li>Using of penetration testing tools and techniques.
</li><li>Applying analytical and problem-solving skills.
</li></ul>Ability
<ul><li>Collaborate with other sections across the department to enhance detection capabilities.
</li><li>Perform Malware analysis.
</li><li>Work closely with management to respond appropriately to the results of assessments and mitigation oversight of found vulnerabilities.
</li><li>Perform data analysis, correlation, and analytics leveraging Security Information and Event Management (SIEM) tools.
</li><li>Conduct vulnerability scans and recognize vulnerabilities in security systems &amp; devices.
</li><li>Accurately and completely source all data used in intelligence, assessment and/or planning products.
</li><li>Apply techniques for detecting host and network-based intrusions using intrusion detection technologies.
</li><li>Interpret the information collected by network tools (e.g. Nslookup, Ping, and Traceroute).
</li><li>Prepare and create regular reports to document any security breaches/ incidents.
</li><li>Provide forensic support to Cyber Security Operations during the investigation of any detected threat or contained incident / event to determine root cause and propose response recommendations as required.
</li></ul>Education and Certification
<ul><li>Bachelor&rsquo;s degree in an information technology, computer science, cyber security or equivalent work experience.
</li><li>CompTIA Security+
</li><li>CISSP: Certified Information Systems Security Professional
</li><li>GCFA: GIAC Certified Forensic Analyst
</li><li>GCIH: GIAC Certified Incident Handler
</li><li>GCIA: GIAC Certified Intrusion Analyst
</li><li>OSCP: Offensive Security Certified Professional
</li><li>CEH: Certified Ethical Hacker
</li><li>CPT: Certified Penetration Tester
</li></ul>Experience
<ul><li>3 years of experience in cyber security operations with expertise in managing the Security Operations Center
</li><li>UAE experience preferred.</li></ul></div>

Information Security Specialist

Verita AI

About Verita AIVerita AI builds high-trust data pipelines that enable AI systems to understand real-world workflows across specialized professional domains. We work with domain experts to teach models how complex technical work actually happens in practice, from routine security operations to high-stakes incident response and threat analysis.Brief DescriptionWe're hiring Cybersecurity specialists to help train and evaluate AI systems on real-world security workflows. You will translate deep security expertise into structured tasks and evaluate AI outputs for technical accuracy, risk awareness, practical applicability, and adherence to established security frameworks.What You'll Do<ul><li>Author high-quality, realistic cybersecurity tasks grounded in professional security operations, including threat detection, vulnerability analysis, incident triage, hardening, and policy review</li><li>Define evaluation criteria and expected outputs so AI-generated security work can be assessed for accuracy, completeness, and appropriate risk prioritization</li><li>Review and evaluate AI-generated security analysis and recommendations for technical correctness and real-world applicability</li><li>Provide detailed feedback to improve AI outputs across security reasoning, tool usage, and defensive strategy</li><li>Document security logic, threat rationale, and framework references clearly</li></ul>Domain Focus<ul><li>Vulnerability assessment and penetration testing</li><li>Incident detection, triage, and response</li><li>Security architecture review and hardening</li><li>Threat modeling and attacker TTP analysis</li><li>Compliance and framework alignment (NIST, CIS, OWASP, MITRE ATT&amp;CK)</li><li>Cloud security posture and configuration review</li></ul>Tools &amp; ContextYou'll work with, or help AI systems reason about, the same tools and artifacts used in professional cybersecurity environments, including:<ul><li>SIEM platforms, log analysis, and alert triage workflows</li><li>Vulnerability scanners and penetration testing tools (Nmap, Burp Suite, Metasploit, Nessus, etc.)</li><li>Network analysis tools (Wireshark, tcpdump, Zeek)</li><li>Security frameworks and standards (NIST CSF, MITRE ATT&amp;CK, CIS Benchmarks, OWASP Top 10)</li><li>Cloud security tooling (AWS Security Hub, Azure Defender, GCP Security Command Center)</li><li>Scripting for automation and analysis (Python, Bash, PowerShell)</li><li>Incident response playbooks and forensic documentation</li></ul>Requirements<ul><li>3+ years of professional experience in cybersecurity, in roles such as security analyst, penetration tester, incident responder, security engineer, or security architect</li><li>Relevant certifications (CISSP, CEH, OSCP, GIAC, CompTIA Security+, or equivalent) or demonstrable hands-on expertise</li><li>Understanding of both offensive and defensive perspectives</li><li>Ability to write clear, well-scoped security tasks with realistic scenarios and unambiguous evaluation criteria</li></ul>You May Be a Good Fit If<ul><li>You've responded to real incidents, triaged real alerts, or tested real systems, not just completed labs</li><li>You can explain why a finding matters in business terms, not just technical ones</li><li>You're comfortable reasoning about attacker behavior and can map TTPs to defensive actions</li><li>You prefer flexible, contract-based engagements over traditional full-time roles</li></ul>How Engagements Work<ul><li>Fully remote, contract-based work</li><li>Minimum commitment: 10 hours per week</li><li>Compensation is hourly, aligned with experience and impact, with payments issued through Deel</li><li>Performance and contribution quality are tracked to support future opportunities</li></ul>Pay: $100.00 - $105.00 per hourWork Location: Remote

Cybersecurity Specialist

Search 6710+ Vulnerability assessment analyst jobs near you this May. New roles added regularly across leading industries. Apply today.