Security, Privacy & GRC - Security
Vulnerability Analyst
IC / Practitioner
Independently auditedProtects the company's systems, data, and customers from real adversaries. Owns a defined area of the function and the outcomes it produces.
Audited package
Built, independently audited role package. Everything on this page is written for this seat.
Your Stack (Swappable)
This role works against whatever tools you already run. We list the tool categories the role operates in, never a named vendor, so you are never asked to replace a system that works.
- Vulnerability & Cloud Posture
- Exploit intel
- IT Ops (RMM/Asset/Backup)
- ITSM / Service Desk
Deliverables
- Detection rules and tuning notes
- Risk and architecture reviews
- Incident write-ups
- Control evidence packs
Responsibilities
- Run authenticated and unauthenticated scans, and chase scan coverage across the asset estate
- Triage and validate raw scanner output - dedup, confirm, and kill false positives before they reach an owner
- Prioritize findings by exploitability (KEV/EPSS) × asset value, not raw CVSS
- Route validated findings to the right owner as tickets with a fix, an owner, and an SLA-based due date
- Track remediation to closure and manage the backlog as a flow (inflow vs. remediation rate, aging)
- Draft exception / risk-acceptance records with compensating controls and review dates for sign-off
- Coordinate patch windows and compensating controls with IT and engineering
- Maintain a false-positive suppression library with written rationale
The essence of this seat
The Vulnerability Analyst is the hands-on individual contributor who turns a firehose of scanner output into a defensible, prioritized remediation program.
Signature move
Check coverage before you chase findings. The first move on any scan is to confirm what it actually covers - which assets are in scope, which are unscanned, which were scanned unauthenticated - because an unscanned or unauthenticated asset is a bigger unknown than any single finding, and you can't triage a picture you can't see
What good looks like
treats coverage and authentication as the precondition for triage, not step two; reconciles scan targets against inventory and names the unscanned/unauthenticated gap; explains why unauthenticated scans both over- and under-count; makes a coverage read the first deliverable rather than a worklist off partial data
Decision rights
- - finding validation, prioritization/scoring, scan scope and cadence, false-positive suppression, and which findings route to which owner
Working vocabulary
What this role does
The Vulnerability Analyst is the hands-on individual contributor who turns a firehose of scanner output into a defensible, prioritized remediation program. Scanners find tens of thousands of issues; this person's job is to decide which few hundred actually matter this week, get them to the right owners with a due date, and prove the backlog is shrinking where it counts. When leadership asks "are we exposed to the vulnerability that's all over the news," this is the person who can answer with evidence instead of a guess. The role sits between the security team, IT/infrastructure, and engineering, and it lives or dies by whether those teams trust the prioritization enough to act on it. A Vulnerability Analyst does not own the risk-acceptance decision and does not set organizational SLAs; they validate, prioritize, route, and track - and surface the decisions others sign. That distinguishes the role from its neighbors: a VM Lead / Security Manager owns the program's risk reporting and sign-off; a SOC Analyst works the real-time alert queue. The closest neighbor is the Security Analyst (016_Security_Analyst/), a broad security-operations generalist who also triages vulnerabilities - but as one slice of a wide remit (architecture review, threat-intel relevance, posture metrics, advisory): they turn a scan into a decision and hand it off. This role picks up where that hand-off lands and runs it as a program - coverage, SLAs, remediation-to-closure, exceptions, and VM metrics. This is the person driving findings to closure day after day. What separates great from average is prioritization discipline and follow-through: ranking by real-world exploitability and asset value rather than raw severity, killing false positives before they reach an owner, and relentlessly tracking remediation to closure instead of publishing a report and moving on.
Best-fit customer
security teams that need consistent triage, review, and evidence quality
Need more than one role?
Buying the whole team or the complete department lowers your effective cost per role at every tier of the ladder.