vulnerability management specialist

SAIC

<div>Job ID: 2611257
Location: Remote Work, VA, US
Date Posted: 2026-04-09
Category: Cyber
Subcategory: Cyber Engineer
Schedule: Full-Time
Shift: Day Job
Travel: Yes - 10% of the time
Minimum Clearance Required: Secret
Clearance Level Must Be Able to Obtain: None
Potential for Remote Work: ORA_REMOTE 
Description
<div>Senior Information Assurance Specialist 
Location: Remote (some onsite work may be required) 
Clearance: Active Secret (or higher) 
Certification: IAT Level II+ (Security+ or equivalent)
About the Role:
SAIC is hiring a Senior Information Assurance Specialist to support the A1 Multi‑Cloud Environment (MCE). In this role, you'll take the lead on endpoint security across multiple GovCloud environments, drive vulnerability remediation efforts, and strengthen cyber resilience for mission‑critical systems. You&rsquo;ll work with modern toolsets like Trellix, Microsoft Defender, ACAS, ServiceNow, Terraform, Ansible, and DevSecOps pipelines to keep DoW environments secure, compliant, and mission‑ready.
If you enjoy solving complex security challenges, modernizing processes, and making a real impact across multi‑cloud environments, this is the role for you.
What You&rsquo;ll Do:
Endpoint Security &amp; Threat Protection<ul><li>
Monitor Trellix (McAfee) and Microsoft Defender dashboards daily for system health and compliance.</li><li>
Identify rogue systems, analyze AMCore status, and review Solidcore/OAS/ODS results.</li><li>
Produce monthly security and compliance reports for leadership.</li><li>
Troubleshoot security installations and upgrades on Windows and RHEL systems.</li></ul>
Vulnerability Management &amp; Incident Response<ul><li>
Analyze ACAS vulnerabilities and work with Cloud Ops to drive remediation using IaC/CaC tools.</li><li>
Manage and resolve security incidents in ServiceNow with clear documentation.</li><li>
Recommend solutions aligned with STIGs and DoD cybersecurity requirements.</li><li>
Ensure full traceability from detection to closure.</li></ul>
Automation &amp; DevSecOps Support<ul><li>
Build and maintain Terraform/Ansible workflows to automate patching and configuration updates.</li><li>
Integrate security checks into DevSecOps pipelines for seamless deployments. 
Identify opportunities to streamline processes and reduce manual tasks.</li></ul>
Collaboration &amp; Technical Support<ul><li>
Manage TMIS tickets and partner with CDO admins and cross‑functional teams.</li><li>
Provide advanced troubleshooting for endpoint security issues.</li><li>
Update and maintain documentation, runbooks, and system configurations.</li></ul>
Reporting &amp; Compliance Assurance<ul><li>
Deliver monthly cybersecurity compliance reports.</li><li>
Ensure alignment with NIST 800‑53, CIS Benchmarks, STIGs, and DoD policies.</li><li>
Maintain audit‑ready documentation and support compliance assessments.</li></ul></div>
Qualifications
Required Qualifications:<ul><li>
Active Secret clearance (or higher).</li><li>
US citizenship.</li><li>
IAT Level II certification (Security+ or equivalent).</li><li>
Bachelors and 5 years of experience; Masters and 3 years of experience.</li><li>
5+ years managing Trellix (McAfee) and Microsoft Defender endpoint security tools.</li><li>
Hands‑on experience with ServiceNow incident workflows.</li><li>
Strong understanding of ACAS vulnerability scanning and reporting.</li><li>
Experience with Terraform, Ansible, or similar IaC/CaC tools.</li><li>
Knowledge of AWS, Azure, or Oracle GovCloud environments.</li><li>
Familiarity with DevSecOps environments and CI/CD security integration.</li><li>
Deep understanding of STIGs and DoD cybersecurity requirements.</li></ul>
Desired Qualifications:<ul><li>
Trellix Certified Endpoint Security Specialist.</li><li>
Microsoft Defender ATP Security Specialist.</li><li>
CISSP or equivalent advanced certification.</li><li>
AWS Security Specialty, AZ‑500, or Oracle Cloud Security certifications.</li><li>
Experience with ESS modules (RSD, OAS/ODS, Solidcore, AMCore).</li><li>
Strong knowledge of encryption, data protection, and DoD vulnerability management tools.</li><li>
Familiarity with NIST 800‑53 and federal IA frameworks.</li><li>
Experience leading incident response and mentoring junior team members.</li><li>
Background working in Agile, Scrum, or SAFe environments.</li></ul>
Target salary range: $120,001 - $160,000. The estimate displayed represents the typical salary range for this position based on experience and other factors.</div>

Senior Information Assurance Specialist

iHeartMedia

<div>iHeartMedia 
Current employees and contingent workers click here to apply and search by the Job Posting Title. 
The audio revolution is here &ndash; and iHeart is leading it! iHeartMedia, the number one audio company in America, reaches 90% of Americans every month - a monthly audience that&rsquo;s twice the size of any other audio company &ndash; almost three times the size of the largest TV network &ndash; and almost 4 times the size of the largest ad-supported music streaming service. In fact, we have:<ul><li>
More #1 rated markets than the next two largest radio companies combined;</li><li>
We&rsquo;re the largest podcast publisher, with more monthly downloads than the second- and third-largest podcast publishers combined. Podcasting, the fastest-growing new media, today has more monthly users than streaming music services or Netflix;</li><li>
iHeart is the home of many of the country&rsquo;s most popular and trusted on-air personalities and podcast influencers, who build important connections with hundreds of communities across America;</li><li>
We create and produce some of the most popular and well-known branded live music events in America, including the iHeartRadio Music Festival, the iHeartRadio Music Awards, the iHeartCountry Festival, iHeartRadio Fiesta Latina and the iHeartRadio Jingle Ball Tour;</li><li>
iHeartRadio is the #1 streaming radio digital service in America;</li><li>
Our social media footprint is 7 times larger than the next largest audio service; and</li><li>
We have the only complete audio ad technology stack in the industry for all forms of audio, from on demand to broadcast radio, digital streaming radio and podcasting, which bring data, targeting and attribution to all forms of audio at an unparalleled scale. As a result, we&rsquo;re able to combine our strong leadership position in audience reach, usage and ad tech with powerful tools and insights for our sales organizations to help them build success for their clients at a more efficient cost than any other option.</li></ul>
Because we reach almost every community in America, we&rsquo;re committed to providing a range of programming that reflects the diversity of the many communities we serve &ndash; and our company reflects that same kind of diversity. Our company values stress collaboration, curiosity, welcoming dissent, accepting mistakes in the pursuit of new ideas, and respect for everyone.
Only one company in America has the #1 position in everything audio: iHeartMedia!
If you&rsquo;re excited about this role but don&rsquo;t feel your experience aligns perfectly with the job description, we encourage you to apply anyway. At iHeartMedia we are dedicated to building a diverse, inclusive, and authentic workplace and are looking for teammates passionate about what we do! 
What We Need:
You will serve as a technical subject matter expert with a strong focus on vulnerability management and a secure developer mindset. Your responsibilities will include designing, defining, and implementing security requirements, controls, and processes to facilitate the secure development and operation of cloud-based and on-premises applications. You will conduct architecture analysis, threat modeling, vulnerability assessments, and technical design reviews for sensitive features and infrastructure to identify risk and guide development and engineering teams in improving the overall security posture of our products. 
 
You will leverage your skills to develop process and automation for vulnerability detection, patch management, and remediation workflows. You will partner with application service teams to implement security standards, and guidelines, as well as educate developers on application and cloud security best practices. Additionally, you will help create, enhance, and maintain security documentation, providing guidance on vulnerability management processes, patching cycles, and zero-day response strategies. 
 
You will evaluate and recommend new and emerging security products and technologies related to vulnerability management, patch management, and cloud security. 
What You'll Do:<ul><li>
Demonstrate leadership aptitude through mentoring and practice maturation.</li><li>
Work independently and collaboratively with various teams.</li><li>
Implement, onboard, and enforce vulnerability management tools and processes (including SAST, SCA, IaC, DAST, IAST) in cloud-based CI/CD pipelines.</li><li>
Coordinate software and cloud security initiatives with relevant teams.</li><li>
Conduct and build data flow diagrams &amp; threat modeling with application and infrastructure teams.</li><li>
Manage manual and automated vulnerability management for priority issues, including zero-day vulnerabilities.</li><li>
Develop and maintain patch management processes and schedules.</li><li>
Assist in developing source code review and vulnerability management checklists.</li><li>
Advise developers and engineers on secure coding and vulnerability mitigation strategies for DevSecOps CI/CD pipelines.</li><li>
Secure code repositories, release environments, and deployment tools.</li><li>
Perform application, cloud, and mobile penetration testing.</li><li>
Lead vulnerability management projects and collaborate with vendors to assess, implement, and utilize new security tools.</li></ul> 
What You'll Need:<ul><li>
Analytical mindset for problem solving, vulnerability prioritization, and offensive security tactics.</li><li>
Effective communication skills, both verbal and written, to clearly convey technical and non-technical concepts to diverse audiences.</li><li>
Current experience in vulnerability assessment, security testing, and remediation methodologies (including browser-based, API, CI/CD pipeline, mobile, and cloud environments).</li><li>
Developer focus and mid-level knowledge of tools such as Terraform, Kubernetes, Serverless functions, Jenkins, and cloud platforms (AWS, Azure, GCP).</li><li>
Experience in secure architectural design review, threat modeling, and technical design reviews.</li><li>
Expertise in patch management, vulnerability prioritization (CVSS, risk-based approaches), and zero-day vulnerability response.</li><li>
Strong knowledge of CI/CD processes and security tools for each stage, including SAST, SCA, IaC, DAST, IAST, and application penetration testing.</li><li>
Hands-on experience with vulnerability exploitation and remediation in applications and cloud environments.</li><li>
Familiarity with repository management (GitHub, TFS, AWS, Azure) and vulnerability management platforms.</li><li>
Experience with manual and automated vulnerability management and resolution across multiple teams.</li><li>
Strong understanding of securing cloud-based resources, including containers and basic services in AWS, GCP, or Azure.</li><li>
Knowledge of configuration and information management analysis (XML, JSON, etc.).</li><li>
Solid grasp of security principles, policies, and industry best practices.</li><li>
Familiarity with standards such as OWASP, SAMM, ASVS, NIST Special Publications.</li><li>
Minimum of 5 years&rsquo; experience in vulnerability management or application security.</li><li>
Minimum of 5 years&rsquo; experience in software development.</li><li>
Minimum of 5 years&rsquo; experience supporting security in CI/CD pipelines.</li><li>
Bachelor&rsquo;s Degree or 7 years developer experience with 3 years of vulnerability management or application security experience, or equivalent required.</li><li>
Certifications in Security, Kubernetes, Docker, AWS, or equivalent are a plus.</li><li>
Ability to stay focused and follow through on tasks in a timely manner.</li></ul> 
What You'll Bring:<ul><li>
Respect for others and a strong belief that others should do this in return</li><li>
Demonstrated initiative and achievement-oriented leadership</li><li>
Ability to manage several projects at a time</li><li>
Growth mindset and desire for continued knowledge sharing and learning</li><li>
Understanding of impact of your own decisions and decisions of your team</li><li>
Strong business insights that contribute to resolving complex problems</li><li>
Catalyst for new and innovative ideas</li><li>
Ability to identify and support new opportunities for continued improvement across business</li><li>
Ability to interact with individuals of all levels and maintain professional relationships</li><li>
Strong relationships with other leaders with the ability to manage external business partners where appropriate</li></ul> 
Location:
San Antonio, TX: 20880 Stone Oak Parkway, 78258 
Position Type:
Regular 
Time Type:
Full time 
Pay Type:
Salaried 
Benefits:
iHeartMedia&rsquo;s benefits offering is flexible and offers a variety of choices to meet the diverse needs of our changing workforce, including the following:<ul><li>
Employer sponsored medical, dental and vision with a variety of coverage options</li><li>
Company provided and supplemental life insurance</li><li>
Paid vacation and sick time</li><li>
Paid company holidays</li><li>
A Spirit day to encourage and allow our employees to more easily volunteer in their community</li><li>
A 401K plan</li><li>
Employee Assistance Program (EAP) at no cost &ndash; services include telephonic counseling sessions, consultation on legal and financial matters, emotional well-being, family and caregiving</li><li>
A range of additional voluntary programs, such as spending accounts, student loan refinancing, accident insurance and more!</li></ul> 
We are accepting applications for this role on an ongoing basis.
The Company is an equal opportunity employer and will not tolerate discrimination in employment on the basis of race, color, age, sex, sexual orientation, gender identity or expression, religion, disability, ethnicity, national origin, marital status, protected veteran status, genetic information, or any other legally protected classification or status.
Non-Compete will be required for certain positions and as allowed by law.
Our organization participates in E-Verify. Click here to learn about E-Verify.</div>

Vulnerability Management, Manager

Motion Recruitment

<div>
 An established
 
 manufacturing company based in Lansdale, PA
 
 is seeking an IT Security Analyst to join its growing cybersecurity team. In this role, you will take ownership of several key security programs, including Vulnerability Management, Third-Party Risk Management, Web Application Firewall (WAF) oversight, and Security Awareness. You will drive the day-to-day execution and coordination of these initiatives while also contributing to core security operations such as incident response, phishing investigations, and SIEM alert monitoring.
 
 
 This position is ideal for someone who enjoys balancing program ownership with hands-on security operations work. You will partner closely with IT, engineering, and business teams to strengthen the organization&rsquo;s security posture across a global manufacturing environment. The ideal candidate brings a foundation in IT or information security (including audit exposure), strong analytical thinking, and the ability to communicate effectively with both technical and non-technical stakeholders.
 
 
 The organization is committed to fostering a diverse and inclusive workplace where all employees are treated equitably and with respect.
 
 
 
 Required Skills &amp; Experience
 
 
 
 2+ years of experience in Information Security, IT, or a related field
 
 
 Bachelor&rsquo;s degree in Computer Science, Information Systems, or similar discipline
 
 
 Working knowledge of security frameworks such as ISO 27001/2, CIS, or NIST
 
 
 Strong analytical and problem-solving skills with the ability to assess and prioritize risk
 
 
 Exposure to core security domains such as vulnerability management, vendor risk, or security operations
 
 
 Ability to manage tasks independently while contributing to team-based initiatives
 
 
 Strong written and verbal communication skills across a variety of audiences
 
 
 Experience collaborating with cross-functional teams including IT, business units, and leadership
 
 
 Self-driven, organized, and capable of handling multiple priorities simultaneously
 
 
 Strong interpersonal skills and a team-oriented mindset
 
 
 
 Desired Skills &amp; Experience
 
 
 
 Hands-on experience with vulnerability scanning tools and remediation processes
 
 
 Familiarity with third-party/vendor risk assessment practices
 
 
 Exposure to WAF technologies and application security concepts
 
 
 Experience working with SIEM platforms and alert triage
 
 
 Knowledge of phishing analysis and security awareness training tools
 
 
 Understanding of incident response workflows and documentation practices
 
 
 
 What You Will Be Doing
 
 
 
 Leading the vulnerability management lifecycle, including intake, prioritization, tracking, and validation of remediation efforts
 
 
 Analyzing scan results and penetration testing findings, translating them into actionable, risk-based recommendations
 
 
 Managing third-party risk activities, including vendor assessments, risk tracking, and coordination with internal stakeholders
 
 
 Overseeing WAF performance by reviewing alerts, tuning rules, and ensuring alignment with application risk
 
 
 Administering and enhancing the security awareness program, including training delivery, phishing campaigns, and reporting
 
 
 Supporting incident response efforts through investigation, documentation, and follow-up activities
 
 
 Reviewing and analyzing phishing submissions and contributing insights to improve user awareness
 
 
 Participating in SIEM monitoring, alert triage, and escalation as part of a shared team rotation
 
 
 Collaborating with infrastructure, application, and business teams to continuously improve security controls
 
 
 
 Tech Breakdown
 
 
 
 35% Vulnerability Management
 
 
 20% Third-Party Risk Management
 
 
 15% Security Awareness &amp; Training
 
 
 15% WAF &amp; Application Security
 
 
 15% Security Operations (Incident Response, SIEM, Phishing)
 
 
 
 Daily Responsibilities
 
 
 
 30% Tracking vulnerabilities, coordinating remediation, and producing reports
 
 
 20% Partnering with internal teams and vendors on security initiatives
 
 
 20% Monitoring and responding to alerts, incidents, and phishing activity
 
 
 15% Supporting training programs and analyzing awareness metrics
 
 
 15% Documentation, reporting, and continuous improvement efforts
 
 
 
 The Offer
 
 
 
 
 You Will Receive The Following Benefits
 
 
 
 Competitive salary based on experience
 
 
 Medical, dental, and vision insurance
 
 
 401(k) with company match
 
 
 Paid time off and company holidays
 
 
 Opportunities for career advancement and professional development
 
 
 Exposure to a wide range of security tools and enterprise environments
 
 
 Collaborative, team-focused work culture
 
 
 Applicants must be currently authorized to work in the US on a full-time basis now and in the future.
 
 
 
 Posted By:
 
 Nick Direso
</div>

Cybersecurity Analyst

geidea

<div>
 
 Established in 2008, Geidea epitomises customer focused empowerment and commercial success through continuous innovation
 
 
 Geidea makes best in class digital payment solutions available for all by attracting and leveraging the best creative &amp; entrepreneurial talent in the market Our solutions give any business the chance to get ahead and reach for more no matter their size or maturity. Our technology mirrors our people - Smart, Innovative &amp; Forward Thinkiking
 
 
 To maintain competitive advantage as we grow, we are currently looking for a new "
 
 Cybersecurity Defense Expert"
 
 
 
 
 
 
 
 Job purpose:
 
 
 
 The purpose of this role is to lead the defense against cyber threats through proactive SOC Monitoring, DFIR, Threat Intelligence, and Vulnerability Management, ensuring the integrity, confidentiality, and availability of information systems in all regions.
 
 
 
 
 
 
 Key accountabilities and decision ownership:
 
 
 <ul>
 <li>
 Lead and enhance SOC operations, focusing on real-time threat detection, incident response, and continuous monitoring.
 </li>
 <li>
 Coordinate digital forensics and incident response efforts to mitigate threats efficiently and reduce recovery time.
 </li>
 <li>
 Develop and implement a threat intelligence program to identify and counteract evolving cyber threat
 </li>
 <li>
 Manage the Vulnerability Management Program, including regular assessments, risk prioritization, and remediation strategies.
 </li>
 <li>
 Support the cybersecurity vision and strategy in alignment with defense operations and organizational goals.
 </li>
 <li>
 Oversee information security audits, whether by performed by organization or third-party personnel.
 </li>
 <li>
 Lead integration of standard and non-standard logs in SIEM.
 </li>
 <li>
 Create reports, dashboards, metrics for SOC operations and presentation to Senior Management.
 </li>
 <li>
 Lead team &amp; vendor management overall use of resources and initiation of corrective action where required for Security Operations Center.
 </li>
 <li>
 Develop and maintain enterprise Threat &amp; Vulnerability Management framework and necessary program operational capabilities that include identify, risk assess, and monitor of vulnerability and associated remediation.
 </li>
 <li>
 Maintain control effectiveness and continuously identify gaps in detection controls across the environment, including Geidea&rsquo;s cloud environments.
 </li>
 <li>
 Serve as the process owner of all ongoing activities related to the confidentiality, integrity and availability of information and resources of customers, business partners, employees, and business information, in compliance with the organization's Cyber and Information security policies.
 </li>
 <li>
 Evaluate team performance and build on people capabilities.
 </li>
 </ul>
 
 
 
 
 
 Must have technical / professional qualifications:
 
 
 <ul>
 <li>
 2-3 years of experience
 </li>
 <li>
 Bachelor&rsquo;s degree in computer science, Information Technology, Telecommunications, Electronics &amp; Electrical or any related field.
 </li>
 <li>
 Certifications:
 </li>
 <li>
 GCIH
 </li>
 <li>
 GCFA
 </li>
 <li>
 Experience in cybersecurity architecture design.
 </li>
 <li>
 Experience in NESA IAR, SAMA CSF, PCI-DSS, NCA is a must.
 </li>
 </ul>
 
 
 
 
 Our values guide how we think and act - They describe what we care about the most.
 
 
 
 Customer first
 
 - It&rsquo;s embedded in our design thinking and customer service approach.
 
 
 
 Open
 
 - Openness allows us to constantly improve and evolve.
 
 
 
 Real
 
 - No jargon and no excuses!
 
 
 
 Bold
 
 - Constantly challenging ourselves and our way of thinking.
 
 
 
 Resilient
 
 &ndash; If we fail, we bounce back stronger than before.
 
 
 
 Collaborative
 
 - We know that we can achieve a lot more as a team.
 
 
 We are changing lives by constantly striving for a better solution.
 
 
 Click apply below and become part of the Geidea story
 
</div>

Cybersecurity Defense Expert

Santander Consumer Bank

<div><div><div><h1 class="jobSectionHeader">Associate, Information Security</h1>
New York, New York<div><div>
</div></div><div><div><div>Job ID</div>
<div>Req1563874</div>
</div><div><div>Category</div>
<div>Technology Risk &amp; Cybersecurity</div>
</div><div><div>Date posted</div>
<div>04/11/2026</div>
</div></div></div><div><div>It Starts Here:
Santander is a global leader and innovator in the financial services industry and is evolving from a high-impact brand into a technology-driven organization. Our people are at the heart of this journey and together, we are driving a customer-centric transformation that values bold thinking, innovation, and the courage to challenge what&rsquo;s possible. This is more than a strategic shift. It&rsquo;s a chance for driven professionals to grow, learn, and make a real difference.
If you are interested in exploring the possibilities We Want to Talk to You!
The Difference You Make:
Santander is seeking an Associate, Information Security professional to join the Information Security team within the First Line of Defense. This role is primarily focused on Vulnerability Management, with exposure to Network Security as a secondary or &ldquo;nice to have&rdquo; capability. The ideal candidate is a cybersecurity professional who can support, monitor, and help maintain information security controls across on-premises and cloud environments.
As an Associate, you will:<ul><li>
Protect the Company, customers, and employees by identifying and mitigating technology threats to Santander</li><li>
Support and strengthen Santander&rsquo;s vulnerability management program through scanning, analysis, prioritization, and remediation tracking</li><li>
Help identify security risks, configuration gaps, and control weaknesses across infrastructure, applications, and cloud services</li><li>
Partner with technology and business teams to drive timely remediation and improve security posture</li><li>
Gain exposure to regulatory expectations and enterprise security operations</li><li>
Build a strong foundation in cyber risk management, with optional growth into network security disciplines.</li></ul>
What You Bring:
The role will report directly to the Director of Information Security and functionally to the Santander US Tower Head of Infrastructure Security Services. The Associate Information Security professional will work closely with multiple technology, application, and business teams across the Santander ecosystem to help advise on secure design and implementation of solutions.
Under the guidance of senior security leaders, this role supports the integration of security controls into new and existing systems while ensuring alignment with Santander&rsquo;s information security policies, standards, and regulatory expectations. The role also supports process improvement and automation initiatives, including the use of scripting and prompt engineering techniques to help streamline repetitive audit, risk, and security-related tasks within the Information Security function.
Primary Focus: Vulnerability Management<ul><li>
Create vulnerability scanning schedules and perform scans on a periodic and ad hoc basis to identify vulnerabilities</li><li>
Conduct vulnerability assessments on IT infrastructure, applications, and related information assets</li><li>
Support the operation and governance of the vulnerability management lifecycle</li><li>
Analyze and prioritize vulnerabilities using the Common Vulnerability Scoring System (CVSS), threat intelligence, exploitability, and business context</li><li>
Identify gaps and risks and drive remediation through closure within established timeframes</li><li>
Partner with infrastructure, application, cloud, and business teams to validate findings and support remediation planning</li><li>
Track remediation progress, escalate aging issues, and support risk acceptance processes when needed</li><li>
Establish, track, and report key vulnerability management metrics (e.g., scan coverage, SLA adherence, critical vulnerability aging)</li><li>
Participate in change request reviews assessing security risk and recommend solutions</li><li>
Perform risk assessments and/or control gap analysis against Information Security Policies and Standards</li></ul>
Broader Information Security Responsibilities:<ul><li>
Collaborate with technology teams to advise on secure implementation of solutions across the Santander environment</li><li>
Provide security input during solution design and change activities, ensuring controls are embedded early in the delivery lifecycle</li><li>
Translate information security requirements into practical, business-aligned guidance for partner teams</li><li>
Support automation of repetitive security and audit-related tasks using scripting tools and prompt engineering techniques</li><li>
Implement book-of-work projects and initiatives within scope, on time, and within budget</li><li>
Establish and maintain appropriate governance forums and escalation paths</li><li>
Manage and monitor technology, audit, and regulatory risk through governance, oversight, reporting, and training initiatives</li><li>
Partner with examiners and auditors on technology examinations, gathering information and responding to findings</li><li>
Bachelor's Degree or equivalent work experience: Computer Science or equivalent field. - Required.</li><li>
5+ Years Experience in information security, governance, IT audit, or risk management. - Required.</li><li>
5+ Years SAS experience. - Required.</li><li>
Understanding of regulatory expectations related to technology and cyber risk (e.g., OCC, FFIEC, DORA, SOX, NYS DFS).</li><li>
Experience with cyber security and information security program management and frameworks (e.g., NIST CSF, ISO/IEC 27000, etc.).</li><li>
Working knowledge of security systems or tools such as Qualys, AlgoSec, Microsoft SCCM, Ansible, Red Hat Satellite, ServiceNow (SNOW), CMDB, etc.</li><li>
Proven ability to work in a team environment.</li><li>
Possess the ability to perform under pressure in a challenging environment.</li><li>
A hunger to learn and take on challenging opportunities, contributing to the success of the information security team.</li><li>
Possess a highly developed sense of personal accountability and follow-through with an ability to effectively prioritize multiple tasks and projects.</li><li>
Must take ownership, demonstrate a sense of urgency, and ensure accuracy and quality.</li></ul>
Certifications:<ul><li>
CompTIA Security+, CompTIA Network+, CISSP</li></ul>
It Would Be Nice For You To Have:
Experience in the following areas is considered a plus:<ul><li>
Support oversight of Network Security controls, including firewalls, proxy, Intrusion Prevention Systems (IPS), VPN, Web Application Firewall (WAF), and Network Access Control (NAC), across on-premises and cloud environments</li><li>
Conduct periodic reviews of firewall, proxy, and VPN configurations in accordance with Santander US standards and processes</li><li>
Review firewall configurations to ensure inbound and outbound traffic is limited to what is necessary for business purposes, and that all other traffic is explicitly denied and logged</li><li>
Familiarity with network segmentation, access control principles, and secure rule lifecycle management</li></ul>
What Else You Need To Know:
The base pay range for this position is posted below and represents the annualized salary range. For hourly positions (non-exempt), the annual range is based on a 40-hour work week. The exact compensation may vary based on skills, experience, training, licensure and certifications and location.
Base Pay Range:
Minimum:
$125,000.00 USD<div><div><div><div><div><div><div>
Maximum:</div></div></div></div></div></div></div>
$165,000.00 USD
We Value Your Impact:
Your contribution matters and it&rsquo;s recognized. You can expect a fair and competitive rewards package that reflects the impact you create and the value you deliver. We know rewards go beyond numbers. Offering more than just a paycheck our benefits are designed to support you, your family and your well-being, now and into the future. Santander Benefits - 2026 Santander OnGoing/NH eGuide (foleon.com)
Risk Culture:
We embrace a strong risk culture and all of our professionals at all levels are expected to take a proactive and responsible approach toward risk management.
EEO Statement:
At Santander, we value and respect differences in our workforce. We actively encourage everyone to. Santander is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, genetics, disability, age, veteran status or any other characteristic protected by law. 
 
Working Conditions:
Frequent minimal physical effort such as sitting, standing and walking is required for this role. Depending on location, occasional moving and lifting light equipment and/or furniture may be required. 
 
Employer Rights:
This job description does not list all of the job duties of the job. You may be asked by your supervisors or managers to perform other duties. You may be evaluated in part based upon your performance of the tasks listed in this job description. The employer has the right to revise this job description at any time. This job description is not a contract for employment and either you or the employer may terminate your employment at any time for any reason.
What To Do Next:
If this sounds like a role you are interested in, then please.
We are committed to providing an inclusive and accessible application process for all candidates. If you require any assistance or accommodation due to a disability or any other reason, please contact us at TAOps@santander.us to discuss your needs.</div></div></div></div>

Associate, Information Security

OpenSesame

<div>About OpenSesame

OpenSesame is the trusted partner for Workforce Reinvention in the age of AI. OpenSesame delivers integrated software, curated and customizable content, and expert services &ndash; embedded into existing learning, HR, and work systems &ndash; to help organizations expand their human+AI potential and thrive through change.

Learn more: www.opensesame.com/about

About the Role

As a Senior Security Analyst on our Compliance team, you will play a key role in strengthening OpenSesame's security posture in a fast-moving, high-growth environment. We're looking for someone who brings deep technical security expertise, a proactive mindset, and the ability to turn complex risks into practical, scalable solutions.

This role spans vulnerability management, penetration testing, bug bounty operations, cloud and application security, and audit readiness. You'll partner across Engineering, DevOps, IT, and Compliance to improve security processes, support compliance efforts, and help ensure security is built into how we work, especially as we continue evolving our approach to AI security. We're looking for proven examples from your career that show you can do this job; that you've owned penetration testing programs, built vulnerability management systems, implemented security automation, and helped organizations adopt modern technologies (including AI) securely and responsibly.

You'll be a strong fit if you're detail-oriented, collaborative, and excited to build programs that reduce risk, improve visibility, and support safe innovation across the business.

Performance Objectives

Establish Security Ownership &amp; Technical Depth (0&ndash;6 Months)
<ul>
<li>Develop a comprehensive view of OpenSesame's external attack surface, vulnerabilities, and threat landscape &mdash; integrating signals from CrowdStrike, cloud environments (AWS, GCP), and application security tooling.</li>
<li>Own external penetration testing engagements end-to-end &mdash; including vendor selection, scope design, execution oversight, remediation validation, and executive reporting.</li>
<li>Build and operationalize a structured vulnerability management program &mdash; partnering with DevOps, Engineering, and IT to prioritize and remediate risk effectively.</li>
<li>Stand up scalable evidence collection and control mapping workflows in Drata &mdash; improving audit readiness and reducing manual effort.</li>
<li>Establish strong cross-functional relationships to embed security into engineering, infrastructure, and IT workflows from the outset.</li>
</ul>
Operationalize Continuous &amp; AI-Aware Security (6&ndash;12 Months)
<ul>
<li>Design and implement a continuous penetration testing program that complements annual third-party testing &mdash; leveraging automation, threat modeling, and targeted validation.</li>
<li>Own and mature the bug bounty program &mdash; improving signal quality, triage processes, researcher engagement, and remediation workflows.</li>
<li>Lead implementation of AI security practices across internal systems and product development:
<ul><li>Apply OWASP Top 10 for LLMs / AI systems to identify and mitigate emerging risks</li>
<li>Support adoption and operationalization of ISO 42001 controls</li>
<li>Define secure usage patterns for internal AI tools and third-party AI integrations</li>
</ul></li><li>Partner with Product Engineering to define and enforce secure AI and application baseline requirements &mdash; ensuring security is built into system design, not retrofitted.</li>
<li>Develop automations and tooling (Python, APIs, Make) to continuously collect threat intelligence, validate security baselines, and detect drift across AWS, GCP, GitHub, and SaaS platforms.</li>
<li>Improve Jira and Confluence workflows to create visibility, accountability, and measurable progress across security findings and remediation.</li>
<li>Provide deep technical support during audits &mdash; translating real-world implementations into clear, defensible narratives aligned with ISO 27001, ISO 27701, and ISO 42001.</li>
</ul>
Drive Security Maturity &amp; Compliance Integration (12+ Months)
<ul>
<li>Serve as a senior technical partner to Compliance &mdash; supporting vendor reviews, customer security questionnaires, and control design with practical, implementation-level expertise.</li>
<li>Continuously improve Drata automation and evidence pipelines &mdash; moving toward near real-time compliance visibility.</li>
<li>Partner with Engineering and DevOps leadership to evolve secure development practices, CI/CD security controls, and cloud security baselines.</li>
<li>Establish and refine AI security governance models &mdash; balancing innovation with risk management across internal and customer-facing use cases.</li>
<li>Identify systemic risks, recurring vulnerability patterns, and process inefficiencies &mdash; driving durable, organization-wide improvements.</li>
<li>Contribute to long-term security strategy &mdash; aligning threat management, AI adoption, compliance requirements, and engineering velocity.</li>
</ul>
What Success Looks Like
<ul>
<li>Penetration testing (external and continuous) is predictable, effective, and drives measurable reductions in risk.</li>
<li>Vulnerabilities are prioritized intelligently and remediated within defined SLAs, with clear ownership across teams.</li>
<li>The bug bounty program consistently yields high-quality findings with efficient triage and response.</li>
<li>AI systems and tools are deployed with clear security guardrails aligned to OWASP AI Top 10 and ISO 42001.</li>
<li>Engineering teams proactively incorporate security &mdash; including AI security &mdash; into design and development workflows.</li>
<li>Audit readiness becomes continuous rather than event-driven, with strong evidence pipelines in Drata.</li>
<li>Security is viewed as a strategic enabler of safe innovation, not a bottleneck.</li>
</ul>
You might notice we don't have the typical list of requirements and buzzwords here. That's intentional.

We're looking for proven examples from your career that show you can do this job &mdash; that you've owned penetration testing programs, built vulnerability management systems, implemented security automation, and helped organizations adopt modern technologies (including AI) securely and responsibly.

When you look back a year from now, you'll know you've made OpenSesame more secure, more resilient, and better positioned to innovate with confidence.

Although it should go without saying (but it doesn't), OpenSesame is an equal opportunity employer and we strive to create a welcoming, inclusive environment that celebrates diversity.

Location: This position can be based anywhere in the US. We operate as a remote-first company, and invest in mandatory all-company meetings several times a year in addition to required team travel as necessary.

Performance Driven: We're looking for self-starters with a track record of delivering excellent results, but we're highly selective about who we hire. We don't focus on typical job requirements, instead, we're interested in specific examples from your past experiences. All positions can be based anywhere in the US, and require up to 15 days of travel per year, with senior management and leadership teams requiring up to 35 days.

Compensation: The base salary for this position generally ranges between $130,000 and $160,000, depending on experience. At OpenSesame, we offer a comprehensive benefits package to employees upon hire, including professional development, ISOs, health insurance, 401(k) matching, and paid time off.

Equal Employment Opportunity: OpenSesame is an Equal Employment Opportunity and Affirmative Action employer that values and welcomes diversity. We do not discriminate on the basis of various legally protected characteristics, including criminal history, and strive to provide reasonable accommodations to qualified individuals with disabilities. We prioritize safety and security and may use your information accordingly, and you can contact us for assistance or accommodations during the job application process.

Pay Transparency: At OpenSesame, we prioritize pay transparency, fairness, and equity to create a positive and inclusive work environment, regularly reviewing our compensation practices to align with our values and goals. We provide competitive and fair compensation to our employees based on their skills, experience, and performance.

CPRA (California Candidates): When you submit your application, OpenSesame may collect and use your personal information in accordance with our privacy policy and the CPRA. This may include personal details and employment history, and will only be used for employment-related purposes. We may share this information with third-party service providers, but we will not sell it to third parties. If you have any questions or concerns, please contact us, and for more information on your rights under the CPRA, refer to our privacy policy or the California Attorney General's website.</div>

Senior Security Analyst, Compliance

MANTECH

<div>MANTECH seeks a motivated, career and customer-oriented Program Protection Security Specialist to join our team in El Segundo, CA.
The Program Protection Security Specialist will provide overall general support to a variety of tasks in support of systems engineering processes for the U.S. Space Force Space Access program. You will play a vital role in ensuring mission success by identifying Critical Program Information (CPI), conducting threat and vulnerability assessments, and implementing countermeasures to protect national security interests within the Space Systems Command.
Responsibilities include but are not limited to:<ul><li>
Executing Critical Program Information (CPI) identification and criticality analysis processes to document findings in Supplier-specific Program Protection Plan (PPP) annexes.</li><li>
Conducting comprehensive threat and vulnerability assessments to identify and implement necessary countermeasures and anti-tamper protections.</li><li>
Supporting Launch Services Acquisition by ensuring current security and Program Protection requirements are incorporated into Performance Work Statements and Request for Proposal components.</li><li>
Performing technical analysis of Program Protection Implementation Plans (PPIPs) and conducting surveys to evaluate protection methodologies and countermeasures.</li><li>
Evaluating proposed security waivers and deviations while performing assessments in accordance with applicable system contracts, acquisition plans, and Security Classification Guides (SCG).</li><li>
Reviewing program documentation for public release to ensure compliance with Distribution A requirements, ITAR, and the Commerce Control List (CCL).</li><li>
Supporting integrated security functions including OPSEC, INFOSEC, Physical Security, and the DoD Industrial Security Program (DD254s).</li></ul>
Minimum Qualifications:<ul><li>
Bachelor&rsquo;s Degree in Business, Human Resources, IT Security, or a related field; or equivalent additional experience (4 years).</li><li>
7+ years of related experience as a security specialist or in other related security areas.</li><li>
1+ year of specific experience with NSSL, Launch/Range, DoD, NASA, or industry equivalent security programs.</li><li>
Familiarity with guiding security policies including DoDI 5000.83, DoDM 5200.45, DoDI 5200.39, DoDI 8510.01 (RMF), and AFI 10-701.</li><li>
Experience working across large teams to drive a security agenda and performing technical analysis of security implementation plans.</li></ul>
Preferred Qualifications:<ul><li>
2+ years of relevant SCI experience; SAP experience is considered a significant plus.</li><li>
Familiarity with the National Industrial Security Program Operating Manual (NISPOM) 32 CFR Part 117.</li><li>
Completion of specialized training such as Program Protection for Practitioners (P4C) or DAU Program Protection Planning Awareness.</li><li>
Possession of DSS Facility Security Officer (FSO) or Special Security Officer (SSO) certifications.</li><li>
Proficient in the use of the Microsoft Office Suite and cybersecurity-related tools or certifications.</li></ul>
Clearance Requirements:<ul><li>
An active TS/SCI or TS with SCI eligibility is required prior to hire.</li></ul>
Physical Requirements:<ul><li>
Must be able to remain in a stationary position 50% of the time.</li><li>
Needs to occasionally move about inside the office to access file cabinets, office machinery, etc.</li><li>
Frequently communicates with co-workers, management, and customers, which may involve delivering presentations. Must be able to exchange accurate information in these situations.</li></ul></div>

Program Protection Security Specialist

Search 10000+ Vulnerability management specialist jobs near you this April. New roles added regularly across leading industries. Apply today.