As a Vulnerability Assessment Analyst at AFS, you will play a pivotal role in safeguarding critical systems by configuring and executing vulnerability scans, analyzing threat intelligence, and interpreting vulnerability announcements.

Responsibilities

Your responsibilities will include, but are not limited to:

• Evaluating scan results, preparing comprehensive reports, and briefing leadership on the current risk landscape, emerging threats, and vulnerability status.
• You will also collaborate closely with a team of Information System Security Engineers (ISSEs) and Information System Security Officers (ISSOs), providing essential information assurance and risk management support.
• A key aspect of your work will involve assisting in the development and publication of System Body of Evidence (BOE) artifacts, ensuring that all documentation aligns with security standards and client requirements.
• To excel in this position, you should have hands-on experience with risk assessment and security testing, as well as familiarity with incident response and handling methodologies.

Qualifications

• 2 years of experience with any combination of the following:
  • Experience detecting system and application security threats and vulnerabilities
  • Experience developing and maintaining security documentation
  • Ability to configure and conduct vulnerability scans, assess scan results, and prepare reports
  • Experience supporting information assurance and risk management activities
  • Experience with program eMASS package, uploading STIG checklists, updating POA&Ms, and securing/maintaining ATO status for the program
  • Experience with risk assessment and conducting security testing
  • Hands-on experience supporting and applying the Risk Management Framework (RMF), including System Security Plans (SSP), Plan of Actions and Milestones (POA&M), Security Control Traceability Matrix (SCTM), Risk Assessment Reports (RAR), and Concept of Operations (CONOPS)
  • Familiarity with incident response and handling methodologies

Preferred Qualifications

• 8140 Advanced certification is preferred (at least Basic or Intermediate is required).
• Advanced Certifications:
  • Certified Information Security Manager (CISM)
  • Certified Information Systems Auditor (CISA)
  • Certified Information Systems Security Professional (CISSP)
  • CompTIA Cybersecurity Analyst (CySA+)
  • CompTIA SecurityX (formerly CASP+)
  • CyberSec First Responder (CFR)
  • GIAC Certified Penetration Tester (GPEN)
  • GIAC Systems and Network Auditor (GSNA)
• Knowledge of network protocols • Knowledge of secure system architecture and system monitoring
• Strong security control analysis skills
• Experience conducting and troubleshooting vulnerability assessments
• Understanding of host and network access controls • Additional certifications

Clearance

• An active TS/SCI federal security clearance is required