Enterprise Vulnerability Management Analyst

This role will be focused on operating and improving Ford's Enterprise Vulnerability Management (EVM) efforts within the Global Cybersecurity organization. The role drives security vulnerability identification, assessment and rating, remediation requirements, secure computing practices, and the responsible use of AI-enabled capabilities to improve Cyber defense outcomes. The EVM team has global enterprise-wide responsibilities for driving proactive security processes across infrastructure, including servers, clients, cloud platforms, and networks, as well as software applications in both IT-managed and business-managed portfolios. The team is responsible for the Dynamic Application Security Testing service, which annually tests critical software assets for security vulnerabilities. The team also operates the Enterprise Bug Bounty program, which receives vulnerability submissions from outside security researchers to alert Ford to issues in production systems. This position will also help evaluate and apply large language model (LLM) and agentic AI solutions to enhance vulnerability triage, threat intelligence analysis, remediation guidance, security workflow automation, and decision support while maintaining appropriate governance, validation, and human oversight.

Responsibilities include:

• Daily monitoring of multiple information sources to process threat intelligence data regarding the release of security patches and mitigations of exploitable traits in software.
• Decision-making capability involving knowledge of software used in the Ford environment (in various active states), familiarity with exploitable traits and personal judgment in order to provide effective patch and mitigation evaluation.
• Provide cyber security consultation and direction to IT and business organizations.
• Coordinate cyber security requirements across business organizations and recognize common needs with potential for strategic solutions.
• Develop and keep up to date runbooks, Standard Operating Procedures, and collaboration tools.
• Evaluate and apply large language model and agentic AI capabilities to support Cyber defense use cases such as vulnerability prioritization, threat intelligence summarization, remediation recommendation drafting, workflow automation, and analyst decision support.
• Partner with cybersecurity, engineering, and governance stakeholders to ensure AI-enabled Cyber defense solutions are validated, explainable, auditable, and aligned with enterprise security, privacy, and responsible AI expectations.
• Develop and track metrics to measure and report performance

Minimum requirements:

• Bachelor's degree
• 2+ Years Enterprise IT Experience
• Familiarity with Cyber Security Principles

Preferred requirements:

• Strong written and verbal communication and organizational skills.
• Ability to work independently, follow a disciplined approach, and have an analytical mindset.
• Ability to work well in a small team and be flexible enough to work on any aspect of the team's needs.
• General understanding and awareness of vulnerability management processes, incident management procedures, and common exploit methods
• Experience using large language models, prompt engineering, retrieval-augmented generation, or agentic AI workflows to improve cybersecurity analysis, vulnerability management, threat intelligence processing, or security operations.
• Understanding of AI security considerations, including model output validation, data protection, prompt injection risk, hallucination management, access control, auditability, and human-in-the-loop review for security-critical decisions.
• Familiarity with cybersecurity frontier models and emerging AI-enabled Cyber defense capabilities is a plus.
• General familiarity with one or more vulnerability scanning and management tools a plus, to include: TenableOne, Nmap, Burpsuite, Censys, others.
• Understanding of emerging technology areas is a plus and their implications in regard to cybersecurity.
• Familiarity with Application Security standards and concepts: DevOps and DevSecOps Principles (OWASP, DAST, SAST, SCCA)