Security Analyst

Key Responsibilities

Vulnerability Management

. Own and manage the end-to-end Vulnerability Management process, including intake, triage, and lifecycle tracking of security findings across the organization's systems and assets.

. Classify vulnerabilities by severity, exploitability, and business impact using frameworks such as CVSS, EPSS, and internal risk criteria.

. Plan, coordinate, and manage Quarterly Vulnerability Assessments - scoping targets, engaging scanning tools, reviewing outputs, and driving findings through to resolution.

. Manage the Yearly Penetration Testing cycle, including scoping, vendor coordination, findings review, and tracking remediation commitments through to closure.

. Track key remediation implementations end-to-end, maintaining visibility from initial detection through to verified closure - for example, overseeing the transition of WAF rules from detection mode to prevention mode, ensuring each step is documented, tested, and signed off.

. Coordinate with remediation teams (engineering, DevOps, infrastructure) to ensure timely resolution of findings, providing clear context and prioritization guidance.

. Maintain and update risk acceptance records, ensuring appropriate approvals are obtained, documented, and reviewed on schedule.

. Track and report on remediation SLAs, escalating overdue or high-risk items to the appropriate stakeholders.

. Produce regular status reports and dashboards that communicate the project's overall security posture to technical and non-technical audiences.

Security Visibility & Reporting

. Aggregate vulnerability data from multiple scanning tools and sources into a coherent, unified view of security risk.

. Develop and maintain metrics and KPIs that enable leadership visibility into ongoing security exposure and program effectiveness.

. Present findings, trends, and recommendations in written reports, executive briefings, and team meetings.

Collaboration & Process Improvement

. Act as a liaison between the security team and remediation owners, facilitating communication and removing blockers to resolution.

. Continuously improve vulnerability management workflows, tooling, and documentation.

. Support audit and compliance activities by providing evidence of vulnerability tracking and risk treatment processes.

. Contribute to threat intelligence efforts and stay current on emerging CVEs and attack trends relevant to the organization.

Qualifications Required

. 2+ years of experience in an information security, vulnerability management, or related role.

. Hands-on experience with vulnerability scanning platforms (e.g., Tenable, Qualys, Rapid7, Wiz, or similar).

. Solid understanding of CVSS scoring, vulnerability classification, and risk-based prioritization.

. Experience communicating security findings and risk to both technical teams and business stakeholders.

. Familiarity with common compliance and risk frameworks (e.g., NIST CSF, ISO 27001, SOC 2).

. Familiarity with GovTech's IM8 (Instruction Manual 8) policies and its associated risk-based assessment methodology, including the application of controls, classification of government ICT systems, and conducting or supporting IM8-aligned security reviews.

. Strong organizational skills with the ability to manage multiple workstreams and deadlines simultaneously.

Preferred

. Relevant certifications such as CompTIA Security+, CEH, GWAPT, or equivalent.

. Experience with ticketing and workflow tools (e.g., Jira, ServiceNow) for tracking remediation.

. Scripting or automation skills (Python, Bash) to support data aggregation and reporting workflows.

. Background in cloud security environments (AWS, Azure, GCP).