Senior Software Vulnerability Analyst

Job Description
The DHS CISA Cybersecurity Division (CSD) Vulnerability Management (VM) Disclosure Branch enables the Government to maintain an analytical edge over adversaries and to support vulnerability coordination activities across the United States. The Disclosure Branch has a requirement to develop a vulnerability ecosystem through partnership and platform development and to create assurance in future software products to deployed in various networks through the expansion of the concept of Software-Bills-of-Materials and other mechanisms to uncover trends, provide solutions, and reduce the risk of products deployed on our Nation's networks.

Tharros is seeking a Senior Software Vulnerability Analyst to lead the analytical core of this mission. This is a hands-on technical leadership role for someone with deep vulnerability analysis experience who can dissect complex disclosures, set the standard for how the team reasons about risk, and mentor analysts and engineers. You will drive the hardest analytical problems while shaping how automation and AI scale your judgment across the branch's workload.

What You'll Do:

• Lead in-depth analysis of software vulnerabilities - assessing root cause, exploitability, and impact across components and dependencies.
• Coordinate vulnerability disclosure activities with researchers, vendors, and government partners.
• Analyze dependency and component data to uncover systemic trends and surface risk across the software ecosystem.
• Define analytical standards, triage criteria, and workflows that the rest of the team follows.
• Guide the design of automation and AI/LLM tooling that scales vulnerability analysis, and validate that its output meets a senior analyst's bar.
• Mentor analysts and engineers, and serve as the technical authority on vulnerability assessment within the branch.

Requirements
What We're Looking For:

• Bachelor's degree in computer science, cybersecurity, or a related field.
• 5+ years of hands-on vulnerability analysis experience - assessing, triaging, and reasoning about software vulnerabilities and their impact.
• Deep understanding of the vulnerability lifecycle, disclosure processes, and scoring/classification frameworks (e.g., CVE, CWE, CVSS).
• Proven ability to analyze complex software and dependency relationships.
• Experience leading or mentoring analysts and setting analytical standards (preferred).
• Familiarity with applying automation and AI/LLM tooling to scale vulnerability analysis (preferred).
• Background supporting U.S. Government or critical-infrastructure cybersecurity missions (preferred).
• Strong written and verbal communication skills, with experience coordinating across researchers, vendors, and stakeholders.
• Proficient in Microsoft Office Suite to include Teams or similar workplace chat and videoconferencing tools.

Summary
Tharros combines extensive cyber defense knowledge with the world's preeminent vulnerability expertise to identify and defend against attacks before they become problems. Working at mission speed, we harden mission systems faster and secure them for longer, so agencies never lose the mission edge. Tharros lifts the veil of enterprise cybersecurity to detect zero days before they affect you, enabling mission maneuverability and the confidence to move missions forward.

In the ever-evolving realm of cyberspace, we are dedicated to becoming the paramount defender in the 5th warfighting domain. By pioneering innovative security solutions and fostering an environment of continuous learning and vigilance, we aim to protect the interests of our nation's security. Our commitment to excellence in cybersecurity will establish new benchmarks, transforming the digital landscape into a secure and thriving frontier for future generations.

Tharros. See Everything. Secure Anything.

Tharros is committed to hiring and retaining a diverse workforce. We are proud to be an Equal Opportunity/Affirmative Action Employer and make employment decisions without regard to race, color, religion, creed, sex, sexual orientation, gender identity, marital status, national origin, age, veteran status, disability, or any other protected status.