Vulnerability Management / CTEM Specialist

Dragonfli Group is a cybersecurity and IT consulting firm providing services to federal agencies and Fortune 100 enterprises. Headquartered in Washington, DC, Dragonfli supports clients in securing mission-critical systems across on-site, hybrid, and fully remote environments. Dragonfli Group is seeking a Vulnerability Management / CTEM Specialist to join an embedded security team supporting a large commercial enterprise's transition to a modern Continuous Threat Exposure Management (CTEM) program. This role will lead the implementation of a new CTEM platform, replacing a legacy vulnerability management tool, and will design the surrounding operational processes — from exploitability-based risk scoring and SLA frameworks to exception handling and escalation procedures. The ideal candidate brings 5+ years of experience in vulnerability management or CTEM platform delivery, hands-on integration work with ITSM tools, and the ability to translate technical processes into clear documentation for both technical and executive audiences. This is a contract position involving a large commercial enterprise in the Financial Services industry. Candidates with previous consulting or contracting experience are preferred. U.S. Citizenship or Permanent Residency is required. If hired, all work related to this role must be performed within the continental U.S. Responsibilities:Lead the implementation of a CTEM platform, migrating from a legacy vulnerability management toolDesign and configure connectors, scoring/exploitability models, and consolidation logic across scanners and source systemsValidate data ingestion fidelity across vulnerability scanners and source systemsDesign SLA and exploitability/risk-scoring frameworksBuild exception and risk-acceptance workflowsPerform asset/vulnerability de-duplication and inventory reconciliationStand up critical/high-priority vulnerability escalation processesBuild and validate API-based integrations between the CTEM platform and downstream systems (e.g., ServiceNow)Write Python scripts/automation for data tagging, gap analysis, and reportingBuild role-based dashboards and reporting for analysts, remediation owners, and CISO-level stakeholdersDevelop KPI/metrics frameworks for security operationsAuthor platform configuration documentation, runbooks, and policy/SLA documentationSupport business process mapping and current-state/future-state workflow designDevelop Target Operating Model (TOM) documentation Requirements: Must-Have:Experience with Risk-Based Vulnerability Management (RBVM) / CTEM tools and platforms (e.g., Kenna, Zafran, Rapid7, Tenable, Qualys)Experience with vulnerability management platforms: connectors, scoring/exploitability models, consolidation logic, ticketing integrationExperience validating data ingestion fidelity across scanners and source systemsExperience designing SLA and exploitability/risk-scoring frameworksExperience with exception and risk-acceptance process designExperience with asset/vulnerability de-duplication and asset inventory reconciliationExperience standing up critical/high-priority vulnerability escalation processes5+ years of relevant vulnerability management / cybersecurity consulting experienceU.S. Citizenship or Permanent Residency; ability to work within the continental U.S. Preferred / Nice-to-Have:API-based system integration and validation testing experienceScripting/automation experience (e.g., Python) for data tagging, gap analysis, reporting automationExperience with IT Service Management (ITSM) platforms (e.g., ServiceNow) — workflow design and ticket lifecycle automationExperience building role-based dashboards/reporting for technical and executive audiencesExperience developing KPI/metrics frameworks for security operationsTechnical writing experience (platform configuration documentation, runbooks, policy/SLA documentation)Business process mapping and current-state/future-state workflow designExperience developing Target Operating Model (TOM) documentation Skill(s): Technical Skills:RBVM/CTEM platforms (Zafran, Kenna, Rapid7, Tenable, Qualys)Vulnerability scanner integration and API-based connectorsExploitability/risk-scoring modelsITSM platforms (ServiceNow)Python scripting/automationDashboarding and reporting tools Soft Skills:Cross-functional stakeholder communication (analysts through executives)Technical writing and documentationProcess design and facilitationAbility to work independently within an embedded client team Benefits: Medical — Multiple POS health plan options including an HSA-compatible planDental — PPO coverage for preventive, basic, and major servicesVision — Annual exam, frames, lenses, and contact lens allowance401(k) — Employer match up to 5% of eligible compensationLong-Term Disability — 100% employer-paid coverage at 50% of pre-disability earningsLife Insurance & AD&D — 100% employer-paid coverage valued at $10,000 eachPTO — 15–25 days annually based on tenurePaid Federal Holidays — All 11 federal holidays observed