ZipRecruiter

Log In

2

Remote Vulnerability Management Jobs (NOW HIRING)

NinjaOne

About the role The Vulnerability & Cloud Security Program Manager leads the enterprise ... NinjaOne is #1 on G2 in endpoint management, patch management, remote monitoring and management ...

NinjaOne

About the role The Vulnerability & Cloud Security Program Manager leads the enterprise ... NinjaOne is #1 on G2 in endpoint management, patch management, remote monitoring and management ...

Meta

Security Engineer - Vulnerability Management

$184K/yr

As a Security Engineer on the Scaling - Vulnerability Management team, you'll build ML-based systems that automate how vulnerabilities are identified, triaged, and remediated across Meta's codebase.

Chainguard

Staff Vulnerability Management Engineer

$170K - $231K/yr

Staff Vulnerability Management Engineer The role in a nutshell: You care deeply about the future of ... Flexible & Remote-First Culture: Work remotely with team meetup opportunities, bi-annual ...

previous pagenext page

Showing results 21-40

All Jobsremote JobsTechnology JobsNetworking JobsRemote Vulnerability Management Jobs

Remote Vulnerability Management information

See salary details

$33.5K

$137.7K

$174K

How much do remote vulnerability management jobs pay per year?

As of Aug 27, 2026, the average yearly pay for remote vulnerability management in the United States is $137,745.00, according to ZipRecruiter salary data. Most workers in this role earn between $111,000.00 and $173,000.00 per year, depending on experience, location, and employer.

What is remote vulnerability management?

A Remote Vulnerability Management job involves identifying, assessing, and mitigating security vulnerabilities in an organization's systems, networks, and applications from a remote location. Professionals in this role use various tools to scan for weaknesses, analyze risks, and collaborate with IT and security teams to implement remediation measures. They also monitor threat intelligence, ensure compliance with security policies, and generate reports on findings. Strong knowledge of cybersecurity frameworks, vulnerability assessment tools, and risk management is crucial for success in this role.

What are some typical challenges faced in remote vulnerability management?

Professionals in Remote Vulnerability Management often encounter challenges such as coordinating remediation efforts across global teams, prioritizing vulnerabilities in large, complex environments, and keeping up with rapidly evolving cyber threats. Working remotely also requires proactive communication to ensure all stakeholders stay informed and aligned on security initiatives. You will need to adapt to different IT infrastructures and collaborate effectively with both technical and non-technical colleagues. Successfully navigating these challenges builds your problem-solving skills and deepens your expertise in protecting organizational assets.

What are the key skills and qualifications needed to thrive in remote vulnerability management?

To thrive in Remote Vulnerability Management, you need a solid understanding of cybersecurity principles, vulnerability assessment, and risk mitigation, often supported by a degree in information security or related certifications such as CompTIA Security+ or CISSP. Familiarity with vulnerability scanning tools like Nessus, Qualys, or Rapid7, as well as experience with SIEM platforms and ticketing systems, is essential. Strong analytical skills, problem-solving abilities, and effective written communication are critical for collaborating with distributed teams and reporting findings. These skills ensure accurate identification, remediation of security risks, and smooth teamwork in a remote, fast-paced digital environment.

More about Remote Vulnerability Management jobs

What cities are hiring for Remote Vulnerability Management jobs?

Cities with the most Remote Vulnerability Management job openings:

What are the most commonly searched types of Vulnerability Management jobs?

The most popular types of Vulnerability Management jobs are:

What states have the most Remote Vulnerability Management jobs?

States with the most job openings for Remote Vulnerability Management jobs include:

What job categories do people searching Remote Vulnerability Management jobs look for?

The top searched job categories for Remote Vulnerability Management jobs are:

Remote Vulnerability Management jobs near you
Infographic showing various Remote Vulnerability Management job openings in the United States as of August 2026, with employment types broken down into 93% Full Time, 3% Part Time, and 4% Contract. Highlights an 100% Remote job distribution, with an average salary of $137,745 per year, or $66.2 per hour.

DFC - Vulnerability Management Analyst

cFocus Software Incorporated

Washington, DC • On-site, Remote

Full-time

Re-posted yesterday

Job description

cFocus Software seeks a Vulnerability Management Analyst to join our program supporting the United States International Defense Finance Agency (DFC). This position is remote. This position requires an Active Public Trust clearance.
Qualifications:
  • Active Public Trust clearance
  • B.S. Computer Science, Information Technology, or a related field
  • 5+ years of cybersecurity experience, including three or more years in vulnerability management, security compliance, POA&M management, or a closely related function.
  • Hands-on experience analyzing authenticated scan results and validating vulnerabilities using Tenable Nessus, Qualys, Microsoft Defender, or comparable enterprise platforms.
  • Demonstrated ability to assess vulnerability risk using CVSS, exploitability, CISA KEV status, asset criticality, exposure, mission impact, threat intelligence, and compensating controls.
  • Experience creating and maintaining POA&M records, tracking remediation milestones, reconciling GRC and ticketing systems, validating closure evidence, and documenting false-positive determinations.
  • Working knowledge of FISMA, the NIST Risk Management Framework, NIST SP 800-53 controls, NIST SP 800-40 vulnerability and patch-management principles, CISA KEV/BOD 22-01 requirements, and federal continuous-monitoring expectations.
  • Ability to communicate technical risk clearly to federal cybersecurity leaders, System Owners, engineers, administrators, auditors, and nontechnical stakeholders.
  • Strong analytical writing, data-quality, documentation, prioritization, and time-management skills in a deadline-driven environment.
  • Active Security+, CySA+, CEH, GCVA, CISSP or other relevant security certifications preferred.

Duties:
  • Coordinate authenticated vulnerability scans with DFC stakeholders at frequencies aligned with policy, system criticality, exposure, threat conditions, and Government direction.
  • Analyze output from Tenable, Qualys, Microsoft Defender, and other Government-approved vulnerability, endpoint, configuration, and posture-management platforms.
  • Validate scanner findings against the operational environment and distinguish valid findings from false positives using documented rationale and supporting evidence.
  • Assess and assign severity using CVSS, DFC policy, exploitability, known-exploitation status, asset criticality, external exposure, mission impact, and relevant threat intelligence.
  • Recommend risk-informed remediation priorities, actions, timelines, evidence requirements, and closure criteria.
  • Coordinate with engineering, operations, application, cloud, endpoint, and system administration teams to establish remediation ownership, dependencies, and target completion dates
  • Provide rapid analysis and coordination for CISA Known Exploited Vulnerabilities (KEV), Binding Operational Directive 22-01 requirements, CISA Emergency Directives, vendor-declared zero-days, and vulnerabilities with active exploitation.
  • Notify the ISSM within four hours of applicable CISA notification, vendor disclosure, Government notification, or Contractor identification.
  • Verify exposure across applicable CSAM authorization boundaries and deliver a written impact assessment within one business day.
  • Document affected systems, boundaries and assets; severity; exposure; exploitability; known exploitation; mission impact; remediation ownership; required timelines; recommended action; and residual-risk considerations.
  • Track emergency remediation against CISA-, DFC-, or Government-directed deadlines and provide written confirmation of remediation status, compliance status, residual risk, and closure evidence.
  • Use CSAM as the authoritative POA&M and compliance ledger and ServiceNow as the operational remediation ticketing record.
  • Create complete POA&M items in CSAM within three business days after finding identification or Government direction, unless the Government establishes another deadline.
  • Populate and maintain required fields, including identifier, weakness description, affected system and control, severity, source, responsible owner, required resources, scheduled completion date, milestones, status, residual risk, and closure evidence.
  • Maintain bidirectional traceability so each applicable ServiceNow remediation ticket links to its CSAM POA&M item and each CSAM POA&M record references the appropriate ServiceNow ticket.
  • Track remediation through closure, monitor milestone integrity and aging, and coordinate scheduled-completion-date changes only after federal authorization.
  • Conduct monthly ServiceNow-to-CSAM reconciliation; identify stale or duplicate records, missing links or evidence, inconsistent status, inaccurate dates, and other data-quality issues; issue a written discrepancy log and track gaps to resolution.
  • Prepare risk-acceptance or exception recommendation packages when remediation cannot be completed within applicable timelines or scheduled-completion-date constraints.
  • Document the affected system and weakness, operational and mission impacts, exploitability, exposure, residual risk, compensating controls, remediation constraints, proposed duration and expiration, review interval, and conditions for continued acceptance.
  • Route recommendation packages to the AODR through the COR and ISSM for federal decision and accurately record approved decisions in CSAM.
  • Clearly preserve federal authority: do not accept risk for DFC, approve exceptions, extend POA&M dates without authorization, or make final closure decisions.

Apply