Vulnerability Management Lead

Booz Allen Hamilton

Confirmed live today High trust

Quick summary

Work type
On-site
Location
Reston, VAWashington, DCRiverdale, MDNorfolk, VA
Salary
$99,000–$225,000 / yr
Employment
Full-time
Posted
4 days ago
Freshness
Confirmed live today

Market check

Salary context

Below market

How this pay compares to similar roles

Similar $188k
This role $162k
$83k $246k
below market most similar roles pay here above market

This role pays less than 69% of similar roles. Most pay $161,250–$215,250 — the blue band above. At the midpoint, this role pays about $162k versus about $188k for comparable roles.

Based on 240 similar postings.

Employer

About Booz Allen Hamilton

Booz Allen Hamilton is a management and technology consulting firm that provides analytics, digital, engineering, and cybersecurity solutions primarily to U.S. government agencies and commercial clients. Industry: Management & Technology Consulting

Booz Allen Hamilton currently has 1662 open roles on FindRole.

Listed pay typically runs $86,800–$198,000 across 904 roles with salary data.

Most-posted roles

View all roles at Booz Allen Hamilton

At a glance

TL;DR · Vulnerability Management Lead

The Vulnerability Management Lead serves as a technical lead and trusted advisor to support DoD clients in modernizing ACAS capabilities and designing enterprise-scale STIG compliance solutions. This role involves transitioning Tenable deployments to enterprise vulnerability management services, standardizing scan policies, and designing contractor-operated workflows for remediation tracking and risk acceptance. The professional will integrate ACAS outputs into POA&M processes, align vulnerability management with Zero Trust initiatives, and develop STIG compliance frameworks to enable automation and control inheritance. Key technical requirements include experience with Tenable.sc, Nessus, RMF, NIST 800-53, and SCAP tooling like SCC or OpenSCAP. Candidates should possess skills in Infrastructure as Code, Python, PowerShell, and SQL to automate repeatable tasks and produce defensible artifacts for continuous monitoring and ATO sustainment.

What you'll do

  • Lead ACAS modernization by standardizing scan policies, credentialed coverage, and asset tagging.
  • Design contractor-operated workflows for vulnerability intake, prioritization, remediation tracking, and risk acceptance.
  • Integrate ACAS outputs into customer POA&M processes, ATO sustainment activities, and reporting requirements.
  • Develop enterprise STIG compliance frameworks that enable control inheritance, reuse, and automation.
  • Implement and maintain SCAP or STIG tooling across server, endpoint, and platform technologies.
  • Produce defensible STIG artifacts and evidence packages to support ATOs and continuous monitoring.
  • Automate repeatable tasks using scripting and workflow tooling where feasible.
  • Produce executive-level briefings on cyber risk posture, trends, and remediation effectiveness.

What we're looking for

  • Active TS/SCI clearance and willingness to take a polygraph exam.
  • 4+ years of experience leading automation projects using Infrastructure as Code (IaC).
  • 3+ years of experience supporting DoD or IC customer cybersecurity programs.
  • Experience with ACAS, including Tenable.sc or Nessus, in enterprise environments.
  • Experience designing enterprise STIG compliance solutions.
  • Knowledge of RMF, NIST 800-53, POA&M management, and continuous monitoring.
  • Associate’s degree with 5+ years of IT experience, Bachelor’s with 3+ years, or Master’s with 1+ year of IT experience.
  • Ability to obtain DoD 8570 IAT Level III and Cybersecurity Service Provider certifications within 30-60 days of start date.

More like this

Similar roles

Vulnerability Management & ACAS Administrator

Leidos

Fort Belvoir, VA 8 days ago $107,900–$195,050
ACAS Nessus Tenable Vulnerability Management STIG SCAP Compliance Checker Python PowerShell SQL Linux Microsoft Windows Tanium Trellix Microsoft Defender for Endpoint Virtualization Networking
7+ yrs exp

Vulnerability Management Engineer

Cisco

Remote (Denver, CO) +29 49 days ago
Vulnerability Management Splunk SPL Docker Kubernetes Terraform CloudFormation CI/CD Infrastructure as Code Tenable Qualys Rapid7 CVSS CIS Benchmarks DISA STIGs PCI DSS SOC2 HIPAA FedRAMP Threat Modeling
3+ yrs exp Remote

Lead InfoSec Engineer, Vulnerability Management

S&P Global

New York, NY 7 days ago $125,000–$145,000
Vulnerability Management DAST SAST Qualys Tanium Rapid7 Fortify Checkmarx Veracode Power BI Tableau NIST Cybersecurity Framework ISO 27001 CVE CVSS CWE CISSP CISM CEH GCIH
7+ yrs exp

Cyber Engineer

Booz Allen Hamilton

Aberdeen Proving Ground, MD +1 34 days ago $86,900–$198,000
RMF STIGs ACAS Nessus Python PowerShell SCAP SIEM EDR eMASS NIST SP 800-53 GRC Vulnerability Management Security Architecture Continuous Monitoring cyber‑hardening
8+ yrs exp

Security Risk Management Lead

Affirm

Remote 144 days ago $165,000–$225,000
Python AWS GCP Azure SQL Cursor Claude IAM PCI DSS BI Tools Workflow Orchestration Identity Providers
5+ yrs exp Remote