Today
Secret
Unspecified
IT - Security
Vancouver, WA (Off-Site/Hybrid)
Edgewater’s Vulnerability and Patch Management Coordinator supports the discovery, tracking, risk prioritization, and closure verification of software and configuration vulnerabilities across BPA’s Operational Technology environments. The successful candidate executes within the BPA Vulnerability Management Procedure, prioritizes CISA Known Exploited Vulnerabilities (KEVs), manages ChangeGear IRs, coordinates with Resource Managers (RMs), and administers the vulnerability waiver process—producing the weekly/monthly deliverables.
Deliverables include Weekly technical risk and vulnerability assessments and weekly evaluations/recommendations; Monthly best practice guides focused on vulnerability identification, tracking, KEV handling, waiver hygiene, and evidence sufficiency; Vulnerability source lists, dashboards, and metrics to support continuous improvement. Secret or L clearance needed to be considered.
Qualifications:
2-5+ years of relevant experience in vulnerability management within government, regulated, or critical infrastructure environments, including:
Documenting vulnerability assessments, mitigation plans, and vulnerability-related analysis.
Managing vulnerability tickets and evidence through change/CM processes to closure.
Working knowledge of:
NIST SP 800-53r5 System and Information Integrity; FISMA concepts; NERC CIP context for vulnerability due dates and evidence.
CISA KEV catalog, CVE/CVSS, and vulnerability due date management.
Tool proficiency:
Splunk (Vulnerability Assessment App), Nessus (or equivalent), ChangeGear (or similar ITSM/IR), and CMS baselining; ability to relate RFCs as evidence.
Strong coordination, documentation, and stakeholder communication skills.
Ability to obtain and maintain DOE/BPA access; complete BPA trainings; maintain network access per cadence requirements.
Deliverables include Weekly technical risk and vulnerability assessments and weekly evaluations/recommendations; Monthly best practice guides focused on vulnerability identification, tracking, KEV handling, waiver hygiene, and evidence sufficiency; Vulnerability source lists, dashboards, and metrics to support continuous improvement. Secret or L clearance needed to be considered.
Qualifications:
2-5+ years of relevant experience in vulnerability management within government, regulated, or critical infrastructure environments, including:
Documenting vulnerability assessments, mitigation plans, and vulnerability-related analysis.
Managing vulnerability tickets and evidence through change/CM processes to closure.
Working knowledge of:
NIST SP 800-53r5 System and Information Integrity; FISMA concepts; NERC CIP context for vulnerability due dates and evidence.
CISA KEV catalog, CVE/CVSS, and vulnerability due date management.
Tool proficiency:
Splunk (Vulnerability Assessment App), Nessus (or equivalent), ChangeGear (or similar ITSM/IR), and CMS baselining; ability to relate RFCs as evidence.
Strong coordination, documentation, and stakeholder communication skills.
Ability to obtain and maintain DOE/BPA access; complete BPA trainings; maintain network access per cadence requirements.
group id: 10227575
