Vulnerability Management Analyst

Role Overview

Bain & Company invites applications for the position of Vulnerability Management Analyst within our Cyber Operations team. In this pivotal role, you will manage and mature the enterprise vulnerability and exposure management program while administering security tooling and leading the Continuous Threat Exposure Management (CTEM) initiative.

Key Responsibilities

• Vulnerability Lifecycle Ownership: Drive continuous improvement across asset discovery, scanning, detection, validation, prioritization, remediation governance, rescanning, and closure verification for the entire enterprise.
• Tool Administration: Operate core exposure management platforms including Qualys VMDR, Wiz, and Tanium. Responsibilities include deployment, configuration tuning, integration, and maintaining health of scanners, agents, and sensors.
• CTEM Leadership: Lead the Continuous Threat Exposure Management program by coordinating scoping, discovery, prioritization, validation, and mobilization activities to consolidate findings into a single risk-ranked exposure view.
• Risk Prioritization: Leverage CVSS, EPSS, CISA KEV lists, threat intelligence, and business criticality matrices to effectively prioritize vulnerabilities.
• Governance & Remediation: Establish SLAs for remediation in partnership with IT, infrastructure, cloud, and engineering teams to ensure accountability and resolution of high-risk exposures. Define exception and risk-acceptance standards compliant with audit requirements.
• Reporting & Automation: Develop automated dashboards using native tools, Excel, and BI solutions to track scan coverage, remediation progress, vulnerability aging, and SLA adherence for executive reporting.