vulnerability assessment analyst

Cherokee Federal

<div><div><div><p><b>Vulnerability Management Team Lead
</b></p></div><div><p>Location: Alexandria, VA ( Remote) Clearance: Public Trust Employment Type: Full-time
</p></div><div><p><b>Overview
</b></p></div><div><div>Cherokee-Federal Systems, LLC is seeking an experienced cybersecurity professional to lead a risk ‑ driven vulnerability management program across hybrid on ‑ prem and cloud environments. The ideal candidate will possess deep expertise in infrastructure and security tools, apply critical thinking to identify security gaps, and develop and implement security protocols and risk management improvements. The qualified individual will own discovery, triage, remediation, and reporting of the agency&rsquo;s security posture and lead a small team of cybersecurity analysts to drive measurable reductions in vulnerabilities with Tenable for infrastructure, AppScan for applications, and ServiceNow for workflow and governance. Align operations to FISMA, FedRAMP, and CMMC. Drive measurable reduction in exploitability and clean audit outcomes.<br>
</div></div><div></div><div><p><b>Key Responsibilities
</b></p></div><div><ul><li><div>Lead endtoend vulnerability operations: scanning, validation, prioritization, remediation, exceptions, and verification across onprem , IaaS/PaaS, and SaaS.
</div></li></ul></div><div><ul><li><div>Operate and optimize Tenable (Nessus/Tenable.sc or Tenable.io) for servers, endpoints, network devices, containers, and cloud assets; maintain credentialed scans, schedules, and coverage for both vulnerabilities and configuration audits.
</div></li></ul></div><div><ul><li><div>Manage AppScan for web and API testing; integrate findings into SDLC and DevSecOps workflows; guide developers with reproducible issues and fix recommendations.
</div></li></ul></div><div><ul><li><div>Continue integration of Tenable, Explore/Implement integration of AppScan with ServiceNow Vulnerability Response:
</div></li></ul></div><div><ul><li><div>Autocreate tickets, enrich with asset data from CMDB, assign ownership by CI/service, and track to closure.
</div></li></ul></div><div><ul><li><div>Maintain riskbased SLAs by asset criticality and threat intel; monitor SLA adherence and escalate aging risk.
</div></li></ul></div><div><ul><li><div>Establish cloudspecific controls:
</div></li></ul></div><div><ul><li><div>Use CSP native scanners and posture tools (e.g., AWS Inspector, Azure Defender/Microsoft Defender for Cloud, GCP Security Command Center) and correlate with Tenable.
</div></li></ul></div><div><ul><li><div>Enforce secure configurations with CIS Benchmarks and cloud guardrails; remediate misconfigurations via IaC changes.
</div></li></ul></div><div><ul><li><div>Prioritize with CVSS, CISA KEV, exploit maturity, and exposure context ( internetfacing , privileged paths, highvalue assets).
</div></li></ul></div><div><ul><li><div>Govern exceptions: risk acceptance with compensating controls, timebound approvals, and periodic review.
</div></li></ul></div><div><ul><li><div>Produce executive and compliance reporting: exposure trends, SLA performance, timetoremediate , patch coverage, POA&amp;Ms, and audit artifacts aligned to FISMA/NIST RMF, FedRAMP, and CMMC.
</div></li></ul></div><div><ul><li><div>Partner with SOC/IR to correlate actively exploited vulnerabilities; enable rapid containment for highrisk findings.
</div></li></ul></div><div><ul><li><div>Coordinate patching windows and change management; champion continuous hardening for Windows/Linux, network, databases, and cloud services.
</div></li></ul></div></div><div><div><ul><li><div>Mentor analysts; mature automation, data quality, and process discipline; lead tabletop exercises for patching/vuln scenarios.
</div></li></ul></div><div><p><b>Required Qualifications
</b></p></div><div><ul><li><div>6+ years in cybersecurity with 3+ years leading vulnerability management in hybrid onprem /cloud environments.
</div></li></ul></div><div><ul><li><div>Handson expertise with Tenable (Nessus/Tenable.sc or Tenable.io), AppScan , and ServiceNow Vulnerability Response/CMDB integration.
</div></li></ul></div><div><ul><li><div>Strong grasp of CVE/CVSS, CISA KEV, exploit kits, and modern attack paths; able to translate technical risk to business impact.
</div></li></ul></div><div><ul><li><div>Familiarity with DAST, SAST, CI/CD and Cloud Assessments.
</div></li></ul></div><div><ul><li><div>Proven remediation leadership across Windows/Linux, network devices, containers, and cloud workloads (AWS/Azure/GCP).
</div></li></ul></div><div><ul><li><div>Experience aligning programs to FISMA (NIST 80053/80037 RMF), FedRAMP baselines, and CMMC practices.
</div></li></ul></div><div><ul><li><div>Metrics and reporting proficiency: exposure reduction, SLA compliance, MTTR for vulnerabilities, patch cadence, and POA&amp;M management.
</div></li></ul></div><div><ul><li><div>Clear, direct communicator comfortable with executive briefings and crossfunctional coordination.
</div></li></ul></div><div><p>Preferred Qualifications
</p></div><div><ul><li><div><b>Certifications: </b>Security+, CySA +, CISSP, CEH, GCSA, GCPN; Tenable or ServiceNow VR certifications; AppSec certs (GWAPT) a plus.
</div></li></ul></div><div><ul><li><div>Experience integrating Tenable with ServiceNow VR, CMDB, and change management; familiarity with Jira for developer workflows.
</div></li></ul></div><div><ul><li><div>Knowledge of CIS Benchmarks, NIST 80053, 80040 (patch), 80063, FedRAMP PMO guidance, and cloud security patterns.
</div></li></ul></div><div><ul><li><div>Scripting/automation (Python, PowerShell) for data normalization, ticket enrichment, API integrations, and reporting.
</div></li></ul></div><div><p><b>Key Competencies
</b></p></div><div><ul><li><div>Accountability and speed under pressure.
</div></li></ul></div><div><ul><li><div>Analytical rigor and validation discipline.
</div></li></ul></div><div><ul><li><div>Operational excellence and automation mindset.
</div></li></ul></div><div><ul><li><div>Crisp communication for technical and executive audiences.
</div></li></ul></div></div><div><div><ul><li><div>Collaborative leadership across security, IT ops, cloud, and development.
</div></li></ul></div><div><p>What Success Looks Like
</p></div><div><ul><li><div>Faster timetoremediate against riskbased SLAs; measurable reduction of critical/high exposure across onprem and cloud.
</div></li></ul></div><div><ul><li><div>Accurate asset inventory, clean CMDB linkage, and high scan coverage with low false positives.
</div></li></ul></div><div><ul><li><div>Auditready evidence with strong POA&amp;M management and clear control effectiveness.
</div></li></ul></div><div><ul><li><div>Executive visibility into vulnerability risk, trends, and remediation velocity.<br>
</div></li></ul><div></div><p><b>Keywords (5)
</b></p><ul><li>Vulnerability Management
</li><li>Tenable / Nessus
</li><li>AppScan
</li><li>ServiceNow (VR/CMDB)
</li>CVSS / Risk Scoring<br>
<li>
</li></ul><p></p><p>Similar Job Titles (5)
</p><ul><li>Vulnerability Management Lead
</li><li>Vulnerability Analyst
</li><li>Cybersecurity Engineer
</li><li>Security Operations Lead
</li>Information Security Manager<br>
<li>
</li></ul><p></p><div><div><b>Company Information:
</b></div></div><div><div><b>Cherokee Nation System Solutions (CNSS)</b>is a part of Cherokee Federal &ndash; the division of tribally owned federal contracting companies owned by Cherokee Nation Businesses. As a trusted partner for more than 60 federal clients, Cherokee Federal LLCs are focused on building a brighter future, solving complex challenges, and <b>serving </b>the government&rsquo;s mission with compassion and heart. To learn more about<b>CNSS</b>, visit cherokee-federal.com.<br>
</div></div><div></div><div><div><b>#CherokeeFederal #LI-SM2 #AppC<br>
</b></div></div><div></div><div><div>Cherokee Federal is a military friendly employer. Veterans and active military transitioning to civilian status are encouraged to apply.<br>
</div></div><div></div><div><div><b>Legal Disclaimer: </b>Cherokee Federal is an equal opportunity employer. Please visit cherokee-federal.com/careers for information regarding our Affirmative Action and Equal Opportunity Employer Statement, and Accommodation request.
</div></div><div><div>Many of our job openings require access to government buildings or military installations. Candidates must pass pre-employment qualifications of Cherokee Federal.</div></div></div></div></div><p></p>

Vulnerability Management Team Lead

<div><p><b>Title:</b></p>
Vulnerability Researcher<p></p><p><b>
Why Join Us?</b></p><ul><li><b>
Innovative Projects:</b> KBR&rsquo;s work is at the forefront of engineering, logistics, operations, science, program management, mission IT and cybersecurity solutions.</li></ul><ul><li><b>
Collaborative Environment:</b> Be part of a dynamic team that thrives on collaboration and innovation, fostering a supportive and intellectually stimulating workplace.</li><li><b>
Impactful Work:</b> Your contributions will be pivotal in designing and optimizing defense systems that ensure national security and shape the future of space defense.</li></ul><p>
KBR is seeking a Vulnerability Researcher to support vulnerability discovery and validation efforts against embedded systems and firmware. In this role, you will focus on hands‑on vulnerability research, including building emulation‑backed test environments, developing fuzzing workflows, performing crash triage and root‑cause analysis, and assisting with proof‑of‑concept exploit development in a controlled lab setting.</p><p></p><p>
The Vulnerability Researcher works closely with reverse engineers and senior vulnerability researchers to deliver reproducible findings and high‑quality technical documentation for government customers while continuing to deepen technical proficiency across mission‑relevant domains.</p><p></p><p><b>
Key Responsibilities</b></p><ul><li>
Conduct vulnerability research on embedded targets using asset‑safe approaches such as emulation, virtualization, and controlled experimentation</li><li>
Develop and execute fuzzing campaigns, including target setup, fuzz harness development, seed/corpus management, and coverage‑driven testing</li><li>
Perform crash triage and root‑cause analysis to identify and characterize security vulnerabilities</li><li>
Assist in the development of proof‑of‑concept exploits to validate vulnerability impact in controlled laboratory environments</li><li>
Create and maintain test harnesses and supporting infrastructure to exercise payload delivery and validate behavior repeatably</li><li>
Reverse engineer firmware and binaries as needed to understand vulnerable code paths and exploitation constraints</li><li>
Collaborate with vulnerability researchers, reverse engineers, and developers support mission objectives</li><li>
Document findings and produce technical reports and artifacts suitable for release</li><li>
Research and apply new vulnerability research tools and techniques under senior technical guidance</li></ul><p></p><p><b>
Minimum Qualifications</b></p><ul><li><b>
Security Clearance:</b> Must have an active U.S. government Secret security clearance, which is something only a U.S. citizen can obtain</li><li>
Bachelor&rsquo;s degree in Computer Engineering, Electrical Engineering, Computer Science, or a related field</li><li>
4&ndash;9 years of experience in vulnerability research, reverse engineering, or exploit development</li><li>
Strong understanding of embedded systems, firmware, operating systems, and low‑level software behavior</li><li>
Proficiency in C/C++, Python, and assembly for vulnerability research, harness development, and automation</li><li>
Experience with embedded emulation environments</li><li>
Experience with coverage‑guided fuzzing, fuzz harness development, and crash triage workflows</li></ul><p></p><p><b><br>
Preferred Qualifications</b></p><ul><li>
Experience developing proof‑of‑concept exploits for vulnerability validation</li><li>
Exposure to analysis techniques such as symbolic execution, concolic execution, or taint analysis</li><li>
Experience with hardware‑focused vulnerability research or embedded security testing</li><li>
Demonstrated ability to communicate technical findings clearly in written reports</li></ul><p><b>
Basic Compensation: $99,200 - $130,000 (For Beavercreek, OH Only)</b><br>
The offered rate will be based on the selected candidate&rsquo;s knowledge, skills, abilities and/or experience and in consideration of internal parity.</p><p></p><p>
Belong, Connect and Grow at KBR<br>
<br>
At KBR, we are passionate about our people and our Zero Harm culture. These inform all that we do and are at the heart of our commitment to, and ongoing journey toward being a People First company. That commitment is central to our team of team&rsquo;s philosophy and fosters an environment where everyone can Belong, Connect and Grow. We Deliver &ndash; Together.</p><p></p><p>
KBR is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, disability, sex, sexual orientation, gender identity or expression, age, national origin, veteran status, genetic information, union status and/or beliefs, or any other characteristic protected by federal, state, or local law.</p></div><p></p>

Vulnerability Researcher

Core One

<div><p>Join our team at Core One! Our mission is to be at the forefront of devising analytical, operational and technical solutions to our Nation's most complex national security challenges. In order to achieve our mission, Core One values people first! We are committed to recruiting, nurturing, and retaining top talent! We offer a competitive total compensation package that sets us apart from our competition. Core One is a team-oriented, dynamic, and growing company that values exceptional performance!</p>
<p>
We are seeking experienced <b>Assessment Analyst</b> to support Theater Security Cooperation (TSC) planning, analysis, and reporting efforts in support of USCENTCOM and higher headquarters. This role requires strong analytical expertise, operational planning experiencse, and the ability to contribute to complex, multi-level defense assessments in a dynamic operational environment.</p>
<h2 class="jobSectionHeader"><b>
Responsibilities</b></h2>
<ul><li>Support the collection, analysis, and reporting of periodic assessments for USCENTCOM and higher headquarters.</li>
<li>Develop and present assessment findings to senior leaders and key stakeholder forums.</li>
<li>Contribute to readiness reporting, campaign assessments, and strategic evaluation efforts.</li>
<li>Serve as a lead or supporting analyst for selected campaign plan assessments and related activities.</li>
<li>Coordinate with internal staff and external partners to consolidate data and produce integrated assessment products.</li>
<li>Participate in planning efforts, working groups, and operational planning teams supporting Security Cooperation initiatives.</li>
<li>Assist in the planning and execution of major Security Cooperation events and engagements.</li>
<li>Provide analytical and subject matter expertise to support Security Cooperation planning, strategy development, and decision-making.</li>
<li>Support the use and implementation of assessment tools and systems, including participation in working groups and process improvements.</li>
<li>Provide flexible, responsive support to emerging requirements and evolving mission priorities.</li>
</ul><h2 class="jobSectionHeader"><b>Qualifications</b></h2>
<ul><li>Active TS/SCI clearance.</li>
<li>Bachelor's degree from an accredited college or university (or equivalent experience).</li>
<li>Minimum 10 years of relevant experience in defense analysis, planning, or related functional areas.</li>
<li>Demonstrated knowledge of DoD missions, organizations, and processes.</li>
<li>Experience working as a senior-level contributor on multidisciplinary teams.</li>
<li>Proven ability to collect, analyze, and present complex data in support of operational and strategic assessments.</li>
<li>Strong written and verbal communication skills, including experience briefing senior leadership.</li>
</ul><h2 class="jobSectionHeader"><b>Desired Qualifications</b></h2>
<ul><li>Certification in Security Cooperation Planning, Oversight, and Execution Management (Basic or Intermediate).</li>
<li>Prior experience supporting Combatant Command (CCMD) or USCENTCOM operations.</li>
<li>Familiarity with DRRS, CCP, and joint planning and assessment processes.</li>
<li>Experience supporting interagency coordination and multinational engagements.</li>
<li>Knowledge of Security Cooperation planning, programming, and assessment systems (e.g., Socium).</li>
</ul>
<p><i>Core One is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, gender identity, sexual orientation, national origin, or protected veteran status and will not be discriminated against on the basis of disability.</i></p></div><p></p>

Assessments Analyst

Legato, LLC

<div><p><b>Legato, LLC</b> recruiters (Staffing@legatocorp.com) would love to speak with you regarding the following position: <b>Vulnerability Researcher </b>in Dulles, VA.<br>
<b>Security Clearance Required</b>: TS/SCI minimum<br>
<b>**Some Remote Work May Be Available**</b></p>
<p><b>
What You Will Do:</b></p>
<p>
The team covers Our team covers the full life cycle of Vulnerability Research from reverse engineering and emulation, through vulnerability discovery, to productization and effects generation. Key areas of focus include: Hardware debugging using JTAG/gdb, Knowledge on typical embedded systems including UART, boot-up sequences, and updating devices, Reverse Engineering ARM, PPC, or Mips binaries, Discovering Vulnerabilities in firmware, device drivers, or in proprietary embedded operating systems, Repurposing vulnerabilities for specific effects, Static and dynamic Analysis, Fuzzer Development, Malware analysis, and System Emulation. There are a variety of non-traditional methods created to acquire access to computer based systems so the ideal candidate would be someone who enjoys trying new things. The most capable candidates will have a variety of low-level operating systems experience as well as cross-platform vulnerability research. If you've written everything from a kernel paged pool exploit to a simple userland stack-based buffer overflow, built your own adaptable instrumentation and integrated a solver to help you identify and reach code, or modified emulators and JIT engines to add your own instrumentation to help you identify entire classes of vulnerabilities, you'll be right at home.</p><p><br>
Our minimum requirements for this role:</p>
<ul>
<li>Active TS/SCI clearance.</li>
<li>Familiarity with at least one common low-level architecture (x86, ARM, etc) is important, as is the ability to conduct vulnerability research against applications compiled for that architecture.</li>
<li>Experience with software protection and binary armoring is a plus, and familiarity with modern exploit mitigation techniques and counter-measures is a must.</li>
<li>Experience with one of the four platforms: specific platform: Windows, Linux, iOS, embedded.</li>
<li>Development experience is desired, but at least some scripting experience is required. Whether in python, ruby, or some other language, you should be capable of quickly developing the instruments needed to help you succeed in your reverse engineering and vulnerability research efforts..</li>
<li>Candidates must be able to defeat advanced security techniques. Projects will be undertaken in small teams with close coordination with customers to quickly enhance capabilities or resolve issues in existing tools.</li>
<li>Working as part of a team you will also need to be familiar with source management tools such as GIT and team coordinating instruments like Atlassian suite of work products</li></ul><br>
<p></p>
<p><b>
About Your New Company</b><br>
Legato, LLC is a dynamic small business headquartered in Columbia, near Ft. Meade, MD. Our positions include Cyber, Software, Systems, Networking, Data Science and other complex engineering capabilities. We set ourselves apart by having employees in the top of their field and who enjoy working at Legato for its attention to its employees, aggressive compensation, and upward mobility possibilities.<br>
We offer a generous benefits package including individual and family health, vision and dental benefits. A minimum of four (4) weeks of paid time off including a week of sick leave. Legato gives our employees 11 federal holidays off and a 401(k) employer match with no vesting schedule. There is an opportunity to earn referral benefits or bank hours if the contract allows.</p>
<p>
Disclaimer: The salary range provided is an estimate based on current market conditions and may be adjusted based on factors such as experience, skills, and qualifications. The final salary offer will be determined after a thorough review of the candidate's background and alignment with the role. Please note that this range is subject to change and should be considered as a guideline rather than a definitive figure.</p><p><br>
<b>
Legato LLC is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, protected veteran status, or disability status.</b></p></div>

Vulnerability Researcher (BZ)

Center for Accessible Technology

<p><b>Overview</b><br/>The Center for Accessible technology (C4AT) is seeking a highly motivated and detail-oriented VPAT / ACR Digital Accessibility Analyst to lead efforts in evaluating and ensuring digital accessibility compliance across various platforms and applications. This role is vital in promoting inclusive digital experiences by analyzing, testing, and documenting accessibility conformance in accordance with the Voluntary Product Accessibility Template (VPAT) and Accessibility Conformance Report (ACR) standards. The ideal candidate will have at least three years of as an accessibility analyst with previous VPAT / ACR experience, and possess a strong understanding of accessibility guidelines, testing methodologies, and a passion for fostering accessible technology solutions that serve diverse user needs. Join us to drive impactful change in digital accessibility and champion user-centric design principles.</p><p><b>Duties</b></p><ul><li>Conduct comprehensive accessibility assessments of web, mobile, and software applications using industry-standard tools and manual testing techniques.</li><li>Develop, review, and maintain VPAT and ACR documentation to accurately reflect product accessibility conformance levels.</li><li>Identify, document, and make recommendations to resolve usability issues that have the potential to undermine meaningful and successful use by individuals regardless of difference or disability to resolve code-level accessibility issues for web-based applications.</li><li>Identify accessibility issues and recommend actionable solutions aligned with WCAG (Web Content Accessibility Guidelines) and Section 508 standards.</li><li>Perform detailed testing of mobile applications on Android and iOS platforms, including functional, performance, and usability evaluations.</li><li>Analyze manual, UX and automated test results, perform root cause analysis of accessibility barriers, and facilitate effective troubleshooting to resolve issues efficiently.</li><li>Support user acceptance testing (UAT) efforts by providing guidance on accessibility best practices and verifying fixes prior to product releases.</li></ul><p><b>Qualifications</b></p><ul><li>Proven experience in digital accessibility testing, including hands-on experience with VPAT/ACR documentation standards (3+ years).</li><li>Strong knowledge of assistive technologies such as screen readers (JAWS, NVDA), magnifiers, voice recognition tools, and other adaptive devices.</li><li>Strong communication skills to articulate technical findings clearly to cross-functional teams and stakeholders.</li><li>IAAP WAS Certification or DHS Trusted Tester Certification required.</li><li>Join us as a VPAT / ACR Digital Accessibility Analyst to make a meaningful impact by ensuring our digital products are accessible to all users!</li></ul><p>To Apply: Candidates may apply directly by sending and <b>resume and cover letter</b> to: lstringer@c4at.org or by applying on Indeed. <b>All applications must include a short cover letter summarizing your experience and availability.</b></p><p>Pay: $80.00 per hour</p><p>Work Location: Remote</p>

VPAT / ACR Digital Accessibility Analyst

J5 Consulting

<p></p><div><p>J5 Consulting is a Maryland based company established in 2006 to provide computing and consulting services for government and commercial entities. Our services improve Information System networking performance and compliance and protect electronic assets from loss and compromise. We welcome your application to receive consideration for the following position.</p><p><b>
Introduction:</b></p><div>
The Sponsor&rsquo;s organization provides technical services to other Sponsor organizations in the areas of:<br>
<ul><li>Desktop hardware to include workstations, printers, multi-function devices, monitors, desktop peripherals, large displays, webcams, and a variety of other hardware devices.</li><li>Voice to include networks, VoIP, analog, and digital implementations.</li><li>Audio and video to include desktop VTC, integrated audio and video conference room setups (cameras, speakers, A/V switches, control panels, etc.), and multi-VTC integrated room setups.</li></ul><br>
The Contractor shall be required to provide Certification and Accreditation support to advise and assist the stakeholders with the Lifecycle Assessment and Authorization (A&amp;A) process, and develop a Systems Security Plan (SSP).</div><p><b><br>
Required skills and demonstrated experience:</b></p><br>
<ul><li>
Bachelor&rsquo;s degree in management information systems, information assurance, computer engineering, or other closely related IT and cybersecurity discipline or equivalent work experience</li><li>
Demonstrated experience in the Risk Management Framework (RMF) methodology.</li><li>
Demonstrated experience managing document repositories and databases.</li><li>
Demonstrated experience in the use of process tracking and document control software</li><li>
Demonstrated experience with writing, communications, and briefing skills.</li><li>
Demonstrated experience with technical guidance and oversight both to technical and non-technical, senior level personnel.</li><li>
Demonstrated experience organizing, planning and prioritizing multiple tasks to complete work on schedule.</li><li>
Demonstrated experience in INFOSEC policies, regulations, and guidance&rsquo;s.</li><li>
Demonstrated experience with cyber risks such as malware, zero-day attacks, denial of service attacks, as well as associated mitigations regarding computer and network devices.
</li><li>Demonstrated pattern of excellent customer service skills and the ability to collaborate with customers at all levels.</li></ul><p><b>
Highly desired, though not required, include:</b></p><br>
<ul><li>
Demonstrated experience with the Sponsor&rsquo;s A&amp;A process.</li><li>
Certified Information Systems Security Professional (CISSP).</li><li>
Demonstrated knowledge of the Sponsor&rsquo;s standard project cycle.</li><li>
Demonstrated experience with the Sponsor&rsquo;s diverse information technology infrastructure, including operating systems, major application systems, and network architecture.</li></ul><p>
__________________________________________________________________________________</p><p><b>
US Citizenship:</b></p><ul><li>
This position requires US Citizenship. Verification of US Citizenship to meet federal government security requirements will be confirmed.
</li></ul><p><b>Security Clearance:</b></p><ul><li>
The successful candidate must have an active U.S. Government Top Secret Security Clearance with a Full Scope Polygraph.</li><li><b>
Clearance Verification:</b> This position requires successful verification of the stated security clearance to meet federal government customer requirements. You will be asked to provide clearance verification information prior to an offer of employment.</li></ul><p><b>
Travel:</b></p><ul><li>
 This position is expected to be onsite. The position will be located within the Washington Metropolitan Area (WMA). Local travel/POV will be on an as needed basis, within the local place of performance.</li></ul><p><b><br>
Join J5 Consulting and Grow Your Cybersecurity Career</b></p>
<p>At J5, we&rsquo;re a team of innovators protecting organizations from evolving cyber threats. With 18+ years of success in government and commercial sectors, we offer meaningful opportunities to grow your career.</p>
<p>Enjoy comprehensive benefits, including:</p>
<ul><li>100% employer-paid health coverage</li>
<li>a 6% 401(k) match</li>
<li>PTO</li>
<li>tuition reimbursement</li>
<li>bonuses</li>
<li>professional development, and more.</li>
</ul>
<p><b>Ready to make an impact? Explore our open positions and apply today.</b></p><p>
</p><p>N2sEjICTxI</p></div>

Assessment & Authorization Specialist

Balchem Corporation

<div>
 <strong>
  Company Overview
  <br/>
  <br/>
 </strong>
 Balchem is committed to making the world a healthier place by delivering trusted, innovative, and science-based solutions for the health and nutritional needs of the world. Balchem employs approximately 1,400 employees worldwide who provide the service, quality, and technology that enables our customers to win with their customers. We have built a reputation for delivering results to all of our stakeholders. Founded in 1967, Balchem, a Maryland corporation, became a publicly-traded company in 1970 and is listed on Nasdaq under the symbol &ldquo;BCPC.&rdquo; Our corporate headquarters is located in Montvale, New Jersey, and we have a broad network of sales offices, manufacturing sites, and R&amp;D centers, primarily located in the U.S. and Europe. The Company consists of three business segments: Human Nutrition and Health, Animal Nutrition and Health, and Specialty Products.
 <br/>
 <br/>
 <strong>
  Overview
  <br/>
  <br/>
 </strong>
 Balchem is seeking a SOC Analyst to strengthen our enterprise security posture through effective alert investigation, communication, and vulnerability management. This role combines day-to-day security operations monitoring with hands-on vulnerability lifecycle management, ensuring that findings across our security monitoring, detection, and assessment platforms are understood, prioritized, and remediated in close partnership with our IT infrastructure team.
 <br/>
 <br/>
 The ideal candidate is analytical, detail-oriented, and an excellent communicator, someone who keeps teammates informed, proactively shares updates, and collaborates naturally in a highly communicative IT organization built on shared accountability. You&rsquo;ll have the opportunity to work with modern enterprise security technologies, learn their full capabilities, and contribute ideas for continuous improvement.
 <br/>
 <br/>
 <strong>
  Responsibilities
  <br/>
  <br/>
 </strong>
 <strong>
  Security Operations
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Monitor, triage, and analyze alerts from enterprise detection, monitoring, and security platforms.
  </li>
  <li>
   Perform analytical investigation of alerts to determine legitimacy, root cause, and business relevance, distinguishing genuine threats from false positives.
  </li>
  <li>
   Document investigation findings and communicate results clearly through established collaboration and reporting channels.
  </li>
  <li>
   Support configuration tuning and ongoing optimization of alerting systems under direction, improving signal quality and reducing noise.
  </li>
  <li>
   Other duties as assigned .
   <br/>
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Vulnerability Analysis &amp; Support
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Participate in the configuration, execution, and review of enterprise vulnerability scanning and assessment activities in collaboration with cross-functional IT teams.
  </li>
  <li>
   Analyze vulnerability data from multiple sources, including endpoint protection and scanning platforms, to understand exposure, severity, and environmental relevance.
  </li>
  <li>
   Export, normalize, and curate vulnerability data into clear, well-organized lists to support prioritization and remediation planning.
  </li>
  <li>
   Research vulnerabilities to provide additional context on exploitability, impact, and remediation options.
  </li>
  <li>
   Interface directly with infrastructure leadership, engineers, and other IT staff to help explain findings, answer questions, and clarify remediation guidance.
  </li>
  <li>
   Support remediation efforts by tracking progress, validating updates, and maintaining visibility into vulnerability status for reporting and follow-up.
   <br/>
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Collaboration &amp; Communication
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Work closely with cybersecurity, infrastructure, and IT leadership to ensure consistent awareness and no surprises.
  </li>
  <li>
   Proactively share observations, emerging risks, and opportunities for improvement.
  </li>
  <li>
   Communicate effectively with colleagues at all levels, both verbally and in writing - comfortable reaching out, following up, and keeping others informed.
   <br/>
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Continuous Improvement
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Explore new or enhanced features in existing security tools and raise recommendations when they could benefit Balchem&rsquo;s environment.
  </li>
  <li>
   Support the administration and maintenance of data loss prevention (DLP) and information protection controls designed to safeguard company data.
  </li>
  <li>
   Participate in ongoing system hardening efforts, baseline reviews, and process improvements.
  </li>
  <li>
   Contribute to the development and refinement of internal documentation, runbooks, and playbooks to support consistent operations.
   <br/>
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Qualifications
  <br/>
  <br/>
 </strong>
 Required
 <br/>
 <br/>
 <ul>
  <li>
   Bachelor&rsquo;s degree in Cybersecurity, Computer Science, Information Technology, or related discipline, or equivalent practical experience.
  </li>
  <li>
   3-5 years of experience in security operations, vulnerability management, or endpoint protection analysis.
  </li>
  <li>
   Exceptional communication and follow-through - keeps others informed and initiates discussion when needed.
  </li>
  <li>
   Familiarity with enterprise-class detection, endpoint protection, and vulnerability assessment technologies.
  </li>
  <li>
   Understanding of CVE analysis, remediation coordination, and risk-based prioritization.
  </li>
  <li>
   Proactive mindset - eager to learn evolving toolsets and contribute ideas for improvement.
   <br/>
   <br/>
   <br/>
  </li>
 </ul>
 Nice to Have
 <br/>
 <br/>
 <ul>
  <li>
   Exposure to SIEM platforms and log-based investigation in an enterprise environment.
  </li>
  <li>
   Familiarity with Active Directory, group policies, or enterprise configuration baselines.
  </li>
  <li>
   Experience with scripting, automation, or reporting (PowerShell, Python, Power BI, etc.).
  </li>
  <li>
   Cybersecurity or cloud security certifications are welcome but not required - real-world experience and curiosity matter most.
   <br/>
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Working Conditions
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Some lifting and carrying of equipment is required, up to 40 pounds
  </li>
  <li>
   Travel between locations may be required (NY/NJ)
  </li>
  <li>
   Work involves extensive use of a desktop or laptop computer
  </li>
  <li>
   Most work is performed inside in a normal office environment
  </li>
  <li>
   Some work will be performed in an environmentally controlled server room
   <br/>
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Why Join Balchem
  <br/>
  <br/>
 </strong>
 You&rsquo;ll be part of a collaborative IT and cybersecurity team where communication, initiative, and follow-through are valued as highly as technical skill. Our IT organization is highly-supportive - we help each other troubleshoot, learn, and succeed as a team. This role provides broad visibility across Balchem&rsquo;s infrastructure, ownership of key operational processes, and the opportunity to directly influence how the company detects and mitigates risk.
 <br/>
 <br/>
 The salary range for this role is between $90,000 and $110,000 per year.
</div>


SOC Analyst

Search 8513+ Vulnerability assessment analyst jobs near you this April. New roles added regularly across leading industries. Apply today.