Vulnerability Patch Management Analyst
2 days ago
New York
A client of ours has a need for a Vulnerability Patch Management Analyst for their Midtown Manhattan office in NYC. This position is a contract hybrid role with 3 days a week in the office. ONLY W2, must be a US citizen or GC Holder. NO vendors. Key Responsibilities Vulnerability & Patch Management • Manage the end-to-end vulnerability and patch management lifecycle, including identification, assessment, prioritization, remediation, and validation across infrastructure, applications, systems, network devices, and the software development lifecycle (SDLC)., • Develop and implement risk-based remediation strategies that align vulnerability severity, business impact, and established remediation SLAs., • Monitor remediation progress, identify SLA breaches, maintain Plans of Action and Milestones (POA&Ms), and drive follow-up actions with responsible IT teams., • Coordinate with IT teams to obtain, test, and deploy vendor patches and security updates in a timely manner., • Assess vulnerability exposure and treatment options to ensure remediation efforts are focused on the most critical risks., • Develop, maintain, and enhance VPM policies, procedures, process documentation, playbooks, and runbooks., • Establish and maintain a comprehensive patch management strategy, strengthening governance, accountability, and operational effectiveness. Cybersecurity Monitoring & Incident Response • Analyze security event data, SIEM alerts, and other relevant data sources to identify indicators of attack, suspicious activity, and potential security breaches., • Produce incident reports, support incident coordination, and collaborate with cybersecurity defense teams to facilitate timely investigation and response., • Coordinate with defense teams to ensure security monitoring tools and systems remain operational, current, and effective., • Provide backup support for cybersecurity incidents, projects, and audit remediation activities, including off-hours support when required. Risk, Governance & Compliance • Evaluate vulnerability and patch management effectiveness, ensuring alignment with internal policies, security standards, regulatory expectations, and industry best practices., • Collaborate with the Second Line of Defense (2LOD), IT Risk, Compliance, and internal and external auditors to support control assessments, audit requests, and remediation activities., • Support vulnerability assessments, track system and software updates, and strengthen adherence to approved security tools and processes., • Stay informed of emerging threats, industry trends, and evolving cybersecurity requirements to recommend continuous program improvements. Reporting, Analytics & Program Enhancement • Develop, maintain, and present key performance indicators (KPIs), key risk indicators (KRIs), dashboards, and management reports that provide clear visibility into vulnerability exposure, remediation progress, SLA performance, and program effectiveness., • Deliver accurate, consistent, and actionable reporting to senior management, technology stakeholders, and cybersecurity leadership., • Use data analytics, advanced Excel, Power Query, Power BI, scripting, and AI-enabled automation to streamline manual processes, improve data quality, and enhance operational efficiency., • Translate complex technical findings into clear, actionable insights and strategic recommendations for stakeholders., • Lead initiatives to improve the Americas CIB Vulnerability & Patch Management program through enhanced processes, reporting, automation, and risk-based decision-making. Required Qualifications & Technical Skills • Experience: 5–9 years of relevant experience in vulnerability management, patch management, cybersecurity operations, IT risk, or a related information security role., • Vulnerability & Patch Management: Demonstrated experience managing vulnerability identification, scanning, risk assessment, remediation tracking, patch deployment, SLA monitoring, and POA&Ms., • Security Monitoring: Hands-on experience with Security Information and Event Management (SIEM) tools, including alert analysis, dashboard development, and security reporting., • Vulnerability Management Tools: Experience conducting vulnerability scans, assessing findings, coordinating remediation, and validating treatment outcomes., • Data Analytics & Reporting: Strong proficiency in Power BI, advanced Excel, Power Query, data analysis, pivot tables, and the development of management reporting and dashboards., • Automation & Scripting: Experience with scripting and an ability to apply AI tools and automation techniques to streamline repetitive tasks and improve processes., • Infrastructure & Networking: Strong understanding of network devices and architecture, TCP/IP, network protocols, server operating systems, and vulnerability scanning technologies., • Operating Systems & Technologies: Familiarity with Windows, Linux/Unix, VMware, intrusion detection and prevention technologies (IDS/IPS), and digital forensic discovery concepts., • Security Frameworks & Controls: Knowledge of cybersecurity and IT audit frameworks and standards, including NIST Cybersecurity Framework (CSF), ISO 27001, CIS Controls, and FFIEC guidance., • Governance & Documentation: Understanding of internal controls, security policies, audit requirements, and the development and maintenance of procedures, process manuals, playbooks, and runbooks., • Communication & Collaboration: Strong analytical, interpersonal, and communication skills, with the ability to present technical findings and recommendations to management and collaborate effectively across geographically distributed teams. Education & Preferred Certifications • Bachelor's degree in Information Assurance, Information Security, Computer Science, or a related field, or equivalent professional experience. Relevant certifications are preferred but not required, including: • CISSP – Certified Information Systems Security Professional, • CISM – Certified Information Security Manager, • GCIH – GIAC Certified Incident Handler, • GCIA – GIAC Certified Intrusion Analyst, • GPEN – GIAC Penetration Tester