Mid-Level Vulnerability Management Engineer

As the Vulnerability Management Engineer, you will play a central role in strengthening the client's cyber defense posture.

You will operate the vulnerability-management function, support enterprise scanning and remediation workflows, and help ensure vulnerabilities are identified, prioritized, and addressed in a timely and compliant manner.

In this role, you will:

• Manage, operate, and maintain vulnerability-management infrastructure capable of performing credentialed scans across approved client-managed managed systems, devices, and applications.
• Perform host-based, network-based, application, and database vulnerability scanning and deliver actionable remediation guidance.
• Analyze scan results and network architecture to identify the highest-risk vulnerabilities and recommend appropriate mitigation steps.
• Conduct specialized assessments for High Value Assets (HVAs) and other designated systems, ensuring reports meet HVA requirements.
• Support the implementation, operation, and maintenance of vulnerability-management projects within client's Information Security Project Dashboard.
• Alert technical points of contact to risks posed by vulnerabilities, missing assets, configuration errors, and unauthorized software or hardware.
• Escalate critical vulnerabilities within 24 hours and track remediation to closure in accordance with applicable federal, department, and agency policy and contractual remediation timelines.
• Monitor the CISA Known Exploited Vulnerabilities (KEV) Catalog and other authoritative sources to support timely remediation and compliance with applicable Binding Operational Directives.
• Coordinate with program areas and system owners to prioritize mitigation steps, including end-user mitigation activities when needed.
• Provide risk analysis for identified vulnerabilities and system change requests.
• Drive findings to verified closure through ticketed workflows, coordinating with the separate technical teams that perform system patching, and validate remediation through authenticated re-scans with recorded evidence.
• Maintain regular communication with client and department stakeholders to support collaboration, process improvement, tool tuning, information sharing, and compromise response.
• Monitor government and private-sector vulnerability sources to identify emerging risks that may affect client-managed systems.
• Contribute to vulnerability management reporting and ad hoc compliance deliverables supporting department, DHS, and FISMA requirements.
• Bachelor's degree in a related field, or equivalent experience as allowed by company and contract policy.
• Five or more years of hands-on enterprise vulnerability management and scanning experience.
• Experience administering enterprise scanning platforms such as Tenable.sc, Nessus, Qualys, Rapid7, or similar tools.
• Experience performing credentialed scanning at scale across hybrid environments.
• Experience with host-based, network-based, application, and database vulnerability scanning.
• Direct experience tracking and remediating vulnerabilities against the CISA KEV Catalog and CISA Binding Operational Directives 22-01 and 26-04, successor directives.
• Familiarity with High Value Asset (HVA) assessment requirements.
• Working knowledge of NIST SP 800-53 Rev. 5, FISMA, and FIPS 199.
• Strong analytical, organizational, and communication skills with the ability to work effectively across technical and government stakeholders.
• Ability to meet federal background investigation requirements.

• Active certification such as CISSP, GIAC (GWAPT, GPEN, GCIA), CompTIA Security+/CySA+, or vendor certifications for Tenable or Qualys.
• Experience with cloud vulnerability scanning in AWS and/or Azure.
• Scripting or automation experience using Python, PowerShell, or similar tools.
• Prior support to federal civilian agency cybersecurity programs.

We're invested in the people who make our success possible.

As a K2United employee, you'll enjoy a comprehensive benefits package designed to support your professional and personal well-being, including:

• 401(k) with employer matching
• Low-cost medical coverage for employees and their families
• Paid time off
• Paid leave for jury duty, military service, voting, and other qualifying events
• Wellness stipend, including fitness reimbursement
• Tuition assistance
• Casual work environment
• Technical training and certification support
• Complimentary access to CareerSafe online training courses for employees and their immediate family

K2United is an equal opportunity employer.

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, sexual orientation, gender identity, disability, protected veteran status, or any other characteristic protected by applicable law.