Note: The job is a remote job and is open to candidates in USA. StopAHack.com® is a veteran-founded cybersecurity and technology services company that delivers hands-on expertise to client programs and partner-led engagements. The Remote Vulnerability Management Analyst will operate the vulnerability-management program from intake through closure, managing findings, remediation tickets, triage, and resolution verification. The role will also support cloud security, compliance activities, quarterly user-access reviews, and the rollout of software-composition analysis tools.
Responsibilities
- Serve as the primary operator of the vulnerability-management program
- Monitor and review incoming vulnerabilities and security findings
- Create clear remediation tickets with severity, affected assets, evidence, and required actions
- Assign tickets to the appropriate infrastructure, cloud, application, or engineering teams
- Assist with initial validation, prioritization, and triage based on experience
- Track remediation tickets and follow up with assigned teams through closure
- Escalate overdue, high-risk, or disputed findings to the appropriate stakeholders
- Use Wiz to review vulnerabilities, cloud exposures, misconfigurations, identity risks, and related security findings
- Help distinguish actionable Wiz findings from duplicates, accepted risks, or false positives
- Maintain vulnerability reports, dashboards, status records, and operating documentation
- Use Vanta to support compliance activities, evidence collection, failed-control remediation, and quarterly user-access reviews
- Coordinate access-review activities with system owners and document decisions or required remediation
- Assist with the early rollout and operation of Socket Security for open-source dependency risks
- Work with security, cloud, IT, application, and engineering teams to drive timely remediation
- Support knowledge transfer during the initial handoff period
- Serve as the primary day-to-day operator of the assigned vulnerability-management program
- Coordinate remediation with security, engineering, cloud, IT, and application teams
- Escalate high-risk findings and unresolved remediation issues to program leadership
- Receive initial knowledge transfer from the current resource
Skills
- • Approximately one to three years of professional experience in vulnerability management, security operations, cloud security, cybersecurity analysis, or a related field
- • Hands-on experience reviewing, validating, prioritizing, or tracking vulnerabilities
- • Experience managing remediation tickets from intake through assignment, follow-up, and closure
- • Hands-on professional experience with Wiz
- • Experience with Vanta , user-access reviews, compliance evidence, or comparable compliance workflows
- • Foundational understanding of cloud vulnerabilities, misconfigurations, identity risks, exposed resources, and remediation priorities
- • Experience using Jira, ServiceNow, or another ticketing and workflow-management platform
- • Ability to communicate clearly with technical teams and maintain accurate records
- • Strong organization, persistence, attention to detail, and follow-through
- • Ability to work independently as the primary operator while escalating complex technical decisions appropriately
- • Remote within the United States
- Applicants must be authorized to work in the United States without current or future sponsorship
- • Experience performing technical vulnerability triage
- • Familiarity with CVEs, CVSS, exploitability, asset criticality, compensating controls, and risk-based prioritization
- • Experience with AWS, Microsoft Azure, or Google Cloud Platform
- • Experience supporting quarterly user-access reviews
- • Familiarity with SOC 2, ISO 27001, PCI DSS, HIPAA, or similar compliance programs
- • Experience with Socket Security or another software-composition analysis platform
- • Familiarity with GitHub, pull requests, open-source dependencies, and package manifests
- • Basic knowledge of APIs, Python, PowerShell, Bash, JSON, or YAML
- • Security+, cloud, vulnerability-management, or comparable certifications
Benefits
- Remote within the United States.
- Approximately one week of transition training is expected.
- Support knowledge transfer during the initial handoff period.
Company Overview