Vulnerability Patch Management Analyst

Job Description

A client of ours has a need for a Vulnerability Patch Management Analyst for their Midtown Manhattan office in NYC. This position is a contract hybrid role with 3 days a week in the office.

\n

\n

ONLY W2, must be a US citizen or GC Holder. NO vendors.

\n

\n

Key Responsibilities

\n

Vulnerability & Patch Management

\n

\n
• Manage the end-to-end vulnerability and patch management lifecycle, including identification, assessment, prioritization, remediation, and validation across infrastructure, applications, systems, network devices, and the software development lifecycle (SDLC).

\n

• Develop and implement risk-based remediation strategies that align vulnerability severity, business impact, and established remediation SLAs.

\n

• Monitor remediation progress, identify SLA breaches, maintain Plans of Action and Milestones (POA&Ms), and drive follow-up actions with responsible IT teams.

\n

• Coordinate with IT teams to obtain, test, and deploy vendor patches and security updates in a timely manner.

\n

• Assess vulnerability exposure and treatment options to ensure remediation efforts are focused on the most critical risks.

\n

• Develop, maintain, and enhance VPM policies, procedures, process documentation, playbooks, and runbooks.

\n

• Establish and maintain a comprehensive patch management strategy, strengthening governance, accountability, and operational effectiveness.

\n

\n

Cybersecurity Monitoring & Incident Response

\n

\n
• Analyze security event data, SIEM alerts, and other relevant data sources to identify indicators of attack, suspicious activity, and potential security breaches.

\n

• Produce incident reports, support incident coordination, and collaborate with cybersecurity defense teams to facilitate timely investigation and response.

\n

• Coordinate with defense teams to ensure security monitoring tools and systems remain operational, current, and effective.

\n

• Provide backup support for cybersecurity incidents, projects, and audit remediation activities, including off-hours support when required.

\n

\n

Risk, Governance & Compliance

\n

\n
• Evaluate vulnerability and patch management effectiveness, ensuring alignment with internal policies, security standards, regulatory expectations, and industry best practices.

\n

• Collaborate with the Second Line of Defense (2LOD), IT Risk, Compliance, and internal and external auditors to support control assessments, audit requests, and remediation activities.

\n

• Support vulnerability assessments, track system and software updates, and strengthen adherence to approved security tools and processes.

\n

• Stay informed of emerging threats, industry trends, and evolving cybersecurity requirements to recommend continuous program improvements.

\n

\n

Reporting, Analytics & Program Enhancement

\n

\n
• Develop, maintain, and present key performance indicators (KPIs), key risk indicators (KRIs), dashboards, and management reports that provide clear visibility into vulnerability exposure, remediation progress, SLA performance, and program effectiveness.

\n

• Deliver accurate, consistent, and actionable reporting to senior management, technology stakeholders, and cybersecurity leadership.

\n

• Use data analytics, advanced Excel, Power Query, Power BI, scripting, and AI-enabled automation to streamline manual processes, improve data quality, and enhance operational efficiency.

\n

• Translate complex technical findings into clear, actionable insights and strategic recommendations for stakeholders.

\n

• Lead initiatives to improve the Americas CIB Vulnerability & Patch Management program through enhanced processes, reporting, automation, and risk-based decision-making.

\n

\n

\n

Required Qualifications & Technical Skills

\n

\n
• Experience: 5–9 years of relevant experience in vulnerability management, patch management, cybersecurity operations, IT risk, or a related information security role.

\n

• Vulnerability & Patch Management: Demonstrated experience managing vulnerability identification, scanning, risk assessment, remediation tracking, patch deployment, SLA monitoring, and POA&Ms.

\n

• Security Monitoring: Hands-on experience with Security Information and Event Management (SIEM) tools, including alert analysis, dashboard development, and security reporting.

\n

• Vulnerability Management Tools: Experience conducting vulnerability scans, assessing findings, coordinating remediation, and validating treatment outcomes.

\n

• Data Analytics & Reporting: Strong proficiency in Power BI, advanced Excel, Power Query, data analysis, pivot tables, and the development of management reporting and dashboards.

\n

• Automation & Scripting: Experience with scripting and an ability to apply AI tools and automation techniques to streamline repetitive tasks and improve processes.

\n

• Infrastructure & Networking: Strong understanding of network devices and architecture, TCP/IP, network protocols, server operating systems, and vulnerability scanning technologies.

\n

• Operating Systems & Technologies: Familiarity with Windows, Linux/Unix, VMware, intrusion detection and prevention technologies (IDS/IPS), and digital forensic discovery concepts.

\n

• Security Frameworks & Controls: Knowledge of cybersecurity and IT audit frameworks and standards, including NIST Cybersecurity Framework (CSF), ISO 27001, CIS Controls, and FFIEC guidance.

\n

• Governance & Documentation: Understanding of internal controls, security policies, audit requirements, and the development and maintenance of procedures, process manuals, playbooks, and runbooks.

\n

• Communication & Collaboration: Strong analytical, interpersonal, and communication skills, with the ability to present technical findings and recommendations to management and collaborate effectively across geographically distributed teams.

\n

\n

Education & Preferred Certifications

\n

\n
• Bachelor's degree in Information Assurance, Information Security, Computer Science, or a related field, or equivalent professional experience.

\n

\n

Relevant certifications are preferred but not required, including:

\n

\n
• CISSP – Certified Information Systems Security Professional

\n

• CISM – Certified Information Security Manager

\n

• GCIH – GIAC Certified Incident Handler

\n

• GCIA – GIAC Certified Intrusion Analyst

\n

• GPEN – GIAC Penetration Tester

\n