Vulnerability Management Analyst

Description

Leidos has a career opportunity for a Vulnerability Management Analyst to support the Air Force National Capital Region IT Services program. The AFNCR IT Services program provides support services for information systems for Headquarters Air Force (HAF), Air Force District of Washington (AFDW), Office of the Secretary of Defense (OSD), Joint Chiefs of Staff, and other Air Force activities within the AFNCR, missions to include the Pentagon, Joint Base Andrews (JBA), Joint Base Anacostia-Bolling (JBAB), and other locations, leased spaces, and alternate sites. The major support areas required are IT Operations and Maintenance; Plans, Projects, and Engineering (PP&E); and National Military Command Center (NMCC).

Primary Responsibilities

• Aid in scheduling and running vulnerability scans using Tenable SecurityCenter/Nessus (ACAS) in classified and unclassified environments under senior staff guidance.
• Review scan results to help identify potential CAT I/II/III findings, false positives, and basic configuration issues.
• Support tracking of remediation actions, Plans of Action and Milestones (POA&Ms), and exceptions in accordance with RMF guidance.
• Follow established procedures to validate DISA STIG checklists and work with team members to ensure secure system configurations.
• Help prepare basic vulnerability reports, compliance summaries, and metrics to support leadership briefings and inspection readiness (e.g., CCRI/CORA).
• Aid in maintaining asset groupings, scan zones, and credentialed scanning configurations as directed by senior analysts.
• Cope with Queue Managers, ISSOs, and Engineering teams to support the remediation of high-priority vulnerabilities.
• Maintain data accuracy within ACAS, including proper tagging and grouping for consistent reporting.

Basic Qualifications

• Active DoD Secret clearance required.
• CompTIA Security+ CE or higher DoD 8570 IAT Level II certification must meet 8140 ISSM role qualification.
• Bachelor's Degree and 4-8 years of cybersecurity or system administration experience, with at least 1 year of direct ACAS or Tenable experience.
• Additional education and years of experience may be considered in lieu of a degree.
• Working knowledge of DISA STIGs, vulnerability risk levels, and POA&M remediation strategies.
• Familiarity with NIST SP 800-53, RMF compliance, and Air Force cybersecurity policy (AFMAN 17-130).
• Strong attention to detail, documentation skills, and the ability to interpret technical vulnerability data.

Preferred Qualifications

• Experience supporting USAF, DISA, or other DoD mission systems.
• Familiarity with eMASS, SCAP Compliance Checker (SCC), or HBSS.
• Prior involvement in CCRI/CORA preparation or vulnerability remediation campaigns.
• Ability to communicate risk-based recommendations to both technical and non-technical stakeholders.
• Understanding of automation tools/scripts (e.g., PowerShell, Nessus APIs) to support scan or report optimization.

About Leidos

Leidos is an industry and technology leader serving government and commercial customers with smarter, more efficient digital and mission innovations. Headquartered in Reston, Virginia, with 47,000 global employees, Leidos reported annual revenues of approximately $16.7 billion for the fiscal year ended January 3, 2025. For more information, visit www.Leidos.com.

Pay And Benefits

Pay and benefits are fundamental to any career decision. That's why we craft compensation packages that reflect the importance of the work we do for our customers. Employment benefits include competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement. More details are available at www.leidos.com/careers/pay-benefits.

Securing Your Data

Beware of fake employment opportunities using Leidos' name. Leidos will never ask you to provide payment-related information during any part of the employment application process (i.e., ask you for money), nor will Leidos ever advance money as part of the hiring process (i.e., send you a check or money order before doing any work). Further, Leidos will only communicate with you through emails that are generated by the Leidos.com automated system – never from free commercial services (e.g., Gmail, Yahoo, Hotmail) or via WhatsApp, Telegram, etc. If you received an email purporting to be from Leidos that asks for payment-related information or any other personal information (e.g., about you or your previous employer), and you are concerned about its legitimacy, please make us aware immediately by emailing us at LeidosCareersFraud@leidos.com. If you believe you are the victim of a scam, contact your local law enforcement and report the incident to the U.S. Federal Trade Commission.

Commitment to Non-Discrimination

All qualified applicants will receive consideration for employment without regard to sex, race, ethnicity, age, national origin, citizenship, religion, physical or mental disability, medical condition, genetic information, pregnancy, family structure, marital status, ancestry, domestic partner status, sexual orientation, gender identity or expression, veteran or military status, or any other basis prohibited by law. Leidos will also consider for employment qualified applicants with criminal histories consistent with relevant laws.