Vulnerability Management

Vulnerability Management Cybersecurity Jobs

30 jobs found

Today

Cybersecurity Manager – Threat Hunting

Home Depot / THD Atlanta, GA 🇺🇸 Remote

Atlanta, GA

Today

$170k - $240k/yr Full time Manager Incident Response Information Security

Apply Now

Job Description

Join Home Depot as a Cybersecurity Manager – Threat Hunting. This role leads a proactive threat hunting program, building a high‑performing team, guiding strategy, and applying hands‑on expertise to advance threat‑informed hunting, improve detections, and drive automation and AI‑enabled efficiencies across the hunting lifecycle. The position is based in Atlanta, GA with remote work options, and offers a compensation range of USD 170,000 to 240,000 per year.

The ideal candidate will bring a bachelor’s degree or equivalent and at least 8 years of relevant experience, along with leadership capability to mentor direct reports and shape strategic outcomes.

Responsibilities

Lead execution across teams to reduce vulnerabilities and manage incidents, drive solution delivery, and provide leadership, mentoring, and coaching to direct reports. Align plans with priorities to ensure objectives and deliverables are met.

Global Hunt Operations

Define hunt methodologies
Develop and mature the threat‑informed defense model

Threat Research

Continue developing a hypothesis‑driven hunting program
Collaborate with Threat Intelligence (CTI) to operationalize emerging TTPs

Detection Advancement

Partner closely with Detection Engineering to convert hunts into actionable detections for Threat Detection & Response analysts

Automation

Focus on automation‑first and AI‑assisted hunting
Integrate manual, repeatable processes into an AI / automation pipeline

People Leadership

Define hunt quality standards

Program Metrics

Measure hunt effectiveness, ATT&CK coverage, and detection improvements

Team & Reporting

This position typically reports to a Senior Manager or Director
Direct reports: 6–10

Travel & Work Environment

No travel required
Working conditions: located in a comfortable indoor area with minimal unpleasant conditions

Qualifications

Minimum qualifications: Must be 18 years of age or older and legally permitted to work in the United States
Minimum years of work experience: 8
Minimum education: Bachelor’s degree or equivalent in a related field
Preferred qualifications: 2+ years of previous leadership experience

Competencies

Decision Quality
Drives Engagement
Develops Talent
Manages Conflict

View full job page →

3d ago

Senior Penetration Tester

AMERICAN SYSTEMS Middletown, RI

Middletown, RI

3d ago

$118k - $128k/yr Full time Senior Bash Burp Suite

Apply Now

Job Description

Responsibilities

Plan, execute, and document penetration tests and security assessments of submarine systems to identify and characterize weaknesses.
Evaluate vulnerabilities and security gaps, prioritizing remediation efforts and partnering with engineers to define mitigation strategies.
Conduct in-depth security evaluations of network and system architectures to ensure robust threat protection.
Produce detailed, accurate reports for technical teams and executives, outlining findings, associated risks, and recommended actions.
Collaborate with cross-functional groups including engineering, IT, and operations to embed security into designs and operations.
Design and implement testing tools, techniques, and methodologies to enhance the testing workflow and automate repeatable tasks.
Keep current with evolving cybersecurity trends, tools, and methodologies relevant to maritime and submarine environments.

Requirements

Bachelor’s degree in Computer Science, Cybersecurity, or a related field; advanced degrees are a plus.
Minimum of 5 years in penetration testing, with at least 2 years focused on submarine or maritime systems.
Top Secret Clearance
Certifications such as OSCP, OSCE, CEH, Pentest+, or GPEN are highly desirable.
Proficiency with penetration testing tools (Metasploit, Burp Suite, Nmap) and scripting languages (Python, Bash).
Strong understanding of network protocols and security architecture specific to submarine systems.
Excellent analytical abilities and attention to detail, with the capability to communicate complex security issues across the organization.

Technologies

Metasploit
Burp Suite
Nmap
Python
Bash

Benefits

Healthcare benefits
Paid leave
Retirement plans
Insurance programs
Education and training assistance

Overview

AMERICAN SYSTEMS is an employee-owned federal government contractor delivering strategic solutions in IT, Test & Evaluation, Program Mission Support, Engineering & Analysis, and Training to support national priority programs.

Pay Transparency

AMERICAN SYSTEMS is committed to pay transparency for applicants and employee-owners. The salary range for this position is USD 118,000 to USD 128,000 per year. Actual compensation will be determined based on factors permitted by law. The company provides comprehensive benefits, including healthcare, paid leave, retirement plans, insurance programs, and education and training assistance.

View full job page →

4d ago

Product Security Engineer

Adobe Lehi, UT

Lehi, UT

4d ago

$67 - $84/hr Contract Api Security Application Security Cloud Platforms

Apply Now

Job Description

Adobe, operating through NextDeavor, invites a Contract Product Security Engineer to manage triage, validation, and remediation of external vulnerability reports while coordinating with engineering teams to enhance the bug bounty program.

Location

Lehi, UT (onsite)

Engagement Type

Contract

Responsibilities

Triage incoming vulnerability reports from the bug bounty platform, assessing validity, impact, and scope.
Assign CVSS scores and severity ratings in line with internal guidelines and industry standards.
Reproduce proof-of-concept exploits across web, API, and mobile surfaces to validate reports.
Communicate with external researchers to request clarifications, provide status updates, and manage expectations.
Coordinate confirmed vulnerabilities with product engineering teams for remediation.
Identify duplicates, out-of-scope, or informational reports and close them with clear explanations.
Contribute to internal documentation, triage runbooks, and severity calibration guidelines.
Flag systemic or critical findings to the Bug Bounty team for escalation.

Requirements

3+ years of experience in application security, penetration testing, or a bug bounty/vulnerability disclosure role.
Strong understanding of CVSS v3.1 and hands-on experience applying it to real-world vulnerabilities.
Proficiency with common web vulnerability classes: XSS, SQL injection, SSRF, IDOR, authentication flaws, and business logic issues.
Ability to reproduce and validate PoC exploits using tools such as Burp Suite, browser DevTools, curl, and custom scripts.
Familiarity with bug bounty platforms (e.g., HackerOne, Bugcrowd) and responsible disclosure processes.
Solid written communication skills for clear, constructive responses to external researchers.
Familiarity with attacker techniques against LLM systems and generative AI products.
Knowledge of OWASP Top 10 vulnerabilities and mitigation techniques.

Technologies

Burp Suite
Browser DevTools
curl
HackerOne
Bugcrowd
AWS
Azure
GCP

Benefits

Health insurance
Vision insurance
Dental insurance
401(k)
Paid sick leave

Compensation

Rate: $67.61–$84.51 per hour

Application

This role may fill quickly. Submit your resume to be considered.

View full job page →

5d ago

Senior Penetration Tester

ANALYGENCE, Inc. Washington, DC

Washington, DC

5d ago

Full time Senior Cybersecurity Tools Information Security

Apply Now

Job Description

AnalytGen̄ce, Inc. seeks a Senior Penetration Tester to support a DHS Intelligence and Analysis cybersecurity program in the National Capital Region. This onsite role in Washington, DC centers on advanced penetration testing, software assurance, vulnerability assessment, cyber supply chain risk management, secure cloud and hybrid engineering, and cross-domain security assessment.

Responsibilities

Lead and perform penetration tests, vulnerability assessments, software assurance work, and cyber supply chain risk management activities for Federal mission systems.
Apply end-to-end security testing using established frameworks such as MITRE ATT&CK, OWASP, NIST SP 800-115, and related Federal or IC assessment practices.
Assist with pre-engagement planning, define rules of engagement, gather intelligence, conduct threat modeling, perform vulnerability analysis, exploitation, post-exploitation activities, and reporting.
Utilize approved automated and manual testing methods to identify vulnerabilities, validate exploitability, and evaluate potential business and operational impacts.
Identify vulnerabilities that automated tools frequently miss through expert-driven manual testing techniques.
Evaluate SOC detection and response capabilities through controlled testing activities.
Prepare penetration testing reports, vulnerability assessment reports, software assurance recommendations, and corrective action guidance.
Support software assurance through vulnerability and compliance testing, source code review, static/dynamic analysis, dependency review, and software supply chain risk identification.
Conduct vulnerability assessments and interpret results to propose corrective actions and mitigation strategies.
Support secure cloud, hybrid, DevSecOps, application, identity, API, microservices, CI/CD, Zero Trust, and cross-domain assessment activities.
Maintain secure testing kits and assessment tooling, including patching, configuration updates, and approved tool management.
Update and maintain penetration testing, SCRM, and vulnerability assessment procedures.
Support audits, working groups, and stakeholder briefings related to penetration testing, software assurance, vulnerability assessment, and cyber supply chain risk.
Identify opportunities to improve testing processes, automate assessment workflows, strengthen reporting, and produce metrics for leadership and technical stakeholders.
Translate assessment findings into actionable remediation plans, risk insights, POA&M inputs, dashboards, and decision-ready reporting.

Requirements

Active TS/SCI clearance with polygraph.
More than ten years of related cybersecurity assessment, penetration testing, software assurance, vulnerability assessment, or cyber supply chain risk experience.
At least two years of recent experience in each of the following areas: software assurance, automated-tool assisted penetration testing, vulnerability assessment, security patch management, and secure cloud and hybrid engineering.
Experience with Cross Domain Solutions.
CEH and CISSP certifications, or comparable demonstrable experience.
Experience conducting penetration testing, vulnerability assessments, software assurance, source code review, SCRM, and cyber supply chain management activities.
Experience using both automated tools and manual testing processes to identify, validate, and document vulnerabilities.
Experience producing technical reports, corrective action recommendations, mitigation strategies, and executive-ready summaries.
Strong understanding of vulnerability management, exploitability, secure configuration, remediation validation, and operational risk.
Strong written and verbal communication skills.
Ability to work onsite at a government-approved location as required.

Technologies

MITRE ATT&CK
OWASP
NIST 800-115
Archer
eMASS
Xacta

Preferred Qualifications

Experience in DHS, Intelligence Community, DoD, CISA, classified red team, software assurance, SCRM, CVPA, vulnerability research, or national security cyber assessment roles.
Familiarity with MITRE ATT&CK, OWASP, NIST 800-115, IC Raise the Bar, NIST SP 800-161, CNSSI 1253, DHS 4300C, or related Federal/IC cybersecurity frameworks.
Proven experience testing cloud, application, identity, API, microservices, CI/CD, DevSecOps, Zero Trust, cross-domain, and hybrid TS/SCI environments.
Experience with SBOM analysis, static/dynamic code analysis, dependency review, source code review, exploit validation, secure configuration, and remediation validation.
Hands-on work with GRC platforms such as Archer, eMASS, or Xacta, including translating findings into POA&Ms, dashboards, scorecards, and remediation workflows.

View full job page →

6d ago

Systems Security Engineer

Modern Technology Solutions, Inc Wright-Patterson AFB, OH

Wright-Patterson AFB, OH

6d ago

Full time Cybersecurity Tools Engineer Information Security

Apply Now

Job Description

Based at Wright-Patterson AFB, this Systems Security Engineer role supports secure embedded DoD-focused systems and networks throughout their lifecycle, with a focus on security architecture, RMF/A&A activities, and anti-tamper considerations in embedded avionics. The position demands applying DoD and Air Force engineering principles to enhance performance and sustainability of weapon systems, translating requirements into robust security specifications, and guiding risk management and accreditation efforts.

Responsibilities

Apply an understanding of DoD, Air Force and common engineering/scientific principles, processes and procedures to improve performance and sustainability of existing and future weapon systems.
Translate user requirements into weapon system requirements which will be used to design, develop, fabricate, test and evaluate weapon systems, subsystems and equipment for eventual fielding and deployment.
Perform technical/mission analyses of existing and future operational requirements, assist in developing systems concepts and perform technical trade-off assessments of designs/modifications.
Develop and maintain Risk Management Framework documentation necessary to obtain Authorizations including but not limited to the System Security Plan (SSP), Architecture Analysis Report (AAR), Continuous Monitoring Plan, Security Control Traceability Matrix (SCTM), Security Assessment Report (SAR) and Risk Assessment Report (RAR).
Provide support to produce or review technical documentation for acquisition programs including Cybersecurity Strategy, Test and Evaluation Master Plan (TEMP), Clinger-Cohen Act Compliance, Capabilities Development Document, Concept of Operations and more.
Support system engineering and program management in conducting and reviewing milestone documentation including System Requirements Review (SRR), Preliminary Design Reviews (PDR), Critical Design Reviews (CDR) and Program Management Reviews (PMR).
Perform information system security engineering tasks, ensuring that information security requirements are properly implemented throughout the processes of security architecture, design, development, configuration, and implementation.
Develop, implement, and enforce information systems security policies ensuring system security requirements are addressed during all phases of the acquisition and Information System lifecycle.
Review, analyze and validate system security designs within embedded avionics systems to validate security control and architecture implementations
Conduct Assessment & Authorization (A&A) tasks in accordance with the Risk Management Framework (RMF) and National Institute of Standards and Technology (NIST) policy; identify deficiencies and provide recommendations of risk mitigation to program management.
Employ best practices when implementing security controls, including software engineering methodologies, system/security engineering principles, secure design, secure architecture, and secure coding techniques
Integrate/Develop new techniques to improve Confidentiality, Integrity, and Availability for networks/systems operating at various classification levels
Assist program managers, system engineers and cyber test engineers in conducting Mission Based Cyber Risk Assessments
Identify points of vulnerability, non-compliance with established cybersecurity standards and regulations, and recommend mitigation strategies
Apply knowledge of cybersecurity policy, procedures, and workforce structure to implement secure networking, computing, and enclave environments
Identify system and/or network designs that encompass multiple enclaves to include those with differing data protection/classification requirements

Requirements

Education: BS degree from an accredited university including classes in Computer Science, Cybersecurity, Electrical/Electronics/Systems/Computer Engineering, or related field.
Experience: 5+ years of experience in systems security architecture or engineering, ideally within a government or DoD environment.
Certifications: Relevant certifications related to a Security Architect in accordance with DoD 8140 (CISSP, CISM, CCSP).
Knowledge: Deep understanding of cybersecurity frameworks (NIST) and standards, RMF, DISA STIGs, and system accreditation processes.
Technical Skills: Expertise with security concerns in avionics, embedded systems, Operational Technology and Supervisory Control and Data Acquisition systems. Familiarity with network security, firewalls, intrusion detection/prevention systems, secure coding practices, and vulnerability scanning tools.
Must possess an active Top Secret clearance with eligibility for SCI.

Technologies

NIST
Risk Management Framework (RMF)
DISA STIGs
Firewalls
Intrusion Detection/Prevention Systems
Vulnerability Scanning Tools
Secure Coding Practices

Benefits

Vacation
Health Insurance
Flexible Schedules
Professional Development
ESOP
401k Match
Bonus Program
Mentorship

DESIRED

Experience with government contracting and DoD security program management.
Familiarity with scripting, automation tools, and secure system integration techniques.
Understanding of cloud security in classified environments.

Travel

20% anticipated travel, but could vary

Why MTSI is a great place to work

Interesting Work: Our co-workers support some of the most important and critical programs to our national defense and security.
Values: Our first core value is that employees come first. We challenge our co-workers to provide the highest level of support and service, and reward them with some of the best benefits in the industry.
100% Employee Owned: We have a stake in each other's success, and the success of our customers. It's also nice to know what's going on across the company; we have company wide town-hall meetings three times a year.
Great Benefits - Most Full-Time Staff Are Eligible for:
Starting PTO accrual of 20 days PTO/year + 10 holidays/year
Flexible schedules
6% 401k match with immediate vesting up to $9k annually
Semi-annual bonus eligibility (July and December)
Company funded Employee Stock Ownership Plan (ESOP) - a separate qualified retirement account
Up to $10,000 in annual educational reimbursement
Other company funded benefits, like life and disability insurance
Optional zero deductible Blue Cross/Blue Shield health insurance plan
Track Record of Success: We have grown every year since our founding in 1993.

View full job page →

6d ago

Information Security Engineer - Vulnerability Management III

Hudson Manpower Cincinnati, OH 🇺🇸 Remote

Cincinnati, OH

6d ago

Full time Application Security Cloud Platforms Cybersecurity Tools

Apply Now

Job Description

Hudson Manpower seeks an Information Security Engineer with a focus on Vulnerability Management III to support day-to-day data security operations, monitor IT policy compliance, and coordinate investigation and reporting of security incidents. The role emphasizes vulnerability management across infrastructure and applications and is based in Cincinnati, OH with remote work options.

Responsibilities

Define, deploy, and sustain enterprise security tools and architectures in collaboration with cross-functional teams.
Strengthen the network vulnerability management program across in-scope subsidiaries and affiliates.
Scope security environments and lead the onboarding of new applications, programs, processes, projects, and initiatives into the Enterprise Vulnerability Management Program.
Communicate, escalate, support, and direct the remediation of open vulnerabilities spanning infrastructure, application security, and configuration management.
Perform security research on threats and remediation techniques, advise IS/IT teams, and oversee their implementation.
Proactively monitor and investigate security alerts from managed security service providers and in-house security tools.
Conduct risk assessments to evaluate control effectiveness and assess the impact of proposed changes to processes, applications, and systems.
Provide ad hoc reporting and control evidence as required.
Perform threat analysis and coordinate incident response by interpreting security events.
Support operational information security responsibilities including developing and maintaining standards, procedures, and guidelines for the Enterprise Vulnerability Management Program.
Share knowledge and industry best practices with team members.
Serve as a security engineer and consultant on projects.

Requirements

Experience with Brinq.
Strong communication and presentation abilities, with a proven track record of presenting to senior leaders and large audiences on matters affecting major projects and critical functionality.
Demonstrated leadership in implementations and project execution.
Experience with referrals to principal.
Proven, ongoing experience in vulnerability management, security engineering, and security consulting, among other areas.
Proven experience with proactive threat management, research, escalation, and discovery activities.
Foundational security expertise.
Solid understanding of popular security tooling and how security architecture interrelates with processes and tooling.

Technologies

Qualys
Brinqa
Archer
ServiceNOW
Checkmarx
Prisma
AWS

Benefits

Competitive base compensation
Medical, dental, and vision insurance coverage
Optional life and disability coverage
401(k) with company match and optional profit sharing
Paid vacation
Paid bench time
Training allowance
Eligibility to earn referral bonuses

Location

Remote work option with base location in Cincinnati, OH.

View full job page →

6d ago

Senior Specialist, MAST Application Penetration Tester

KPMG Dallas, TX

Dallas, TX

6d ago

$96k - $208k/yr Full time Senior Application Security Burp Suite

Apply Now

Job Description

At KPMG, you will join a culture that emphasizes integrity, collaboration, and professional growth. This onsite role in Dallas, TX offers a competitive salary range of USD 95,855 to 208,265 per year and a comprehensive benefits package. As part of the MAST team, you will conduct manual testing across APIs, Web and mobile applications, and thick client software, contribute to threat modeling and architecture reviews, and present results to both internal and external audiences.

Responsibilities

Conduct manual penetration testing of APIs (REST and SOAP), Web applications, mobile applications, and thick client applications
Align testing with objective based engagements defined by scope and goals
Perform threat modeling, evaluate business logic, and carry out application architecture reviews
Demonstrate testing work in real time through demos to internal and external audiences
Work independently on penetration testing engagements with minimal oversight
Uphold integrity, professionalism, and personal responsibility to support a respectful work environment

Requirements

At least three years of recent experience in application penetration testing of APIs, web applications, or mobile applications
Bachelor’s degree from an accredited college/university or equivalent industry experience
Ability to communicate reporting results to technical and non technical audiences and lead remediation conversations
Experience with Burp Suite Pro and other testing tools such as Netsparker and Checkmarx
One or more major ethical hacking certifications are preferred but not required (GWAPT, CREST, OSWE, OSWA)
Ability to travel as required
Must be authorized to work in the United States without the need for employment-based visa sponsorship; KPMG LLP will not sponsor applicants for U S work visa status for this opportunity