Vulnerability Management Engineer

Job Title: Vulnerability Management EngineerJob Category: Information TechnologyTime Type: Full timeMinimum Clearance Required to Start: TS/SCIEmployee Type: RegularPercentage of Travel Required: Up to 10%Type of Travel: Continental US* * *

The Opportunity:
Join the Vulnerability Management team as a hands-on cybersecurity professional responsible for identifying, assessing, prioritizing, and driving remediation of vulnerabilities across an enterprise environment. Support the security of mission-critical systems by leveraging enterprise vulnerability management technologies, including the Assured Compliance Assessment Solution (ACAS), to identify and assess security weaknesses. Work closely with cybersecurity, infrastructure, system administration, and application teams to validate findings, coordinate remediation efforts, and reduce organizational risk. Apply knowledge of vulnerability management, security assessment, Linux, enterprise security technologies, and DoD security requirements to support a mature and effective vulnerability management program. Contribute to the continuous improvement of vulnerability management processes, reporting, automation, and risk-based remediation practices.

Responsibilities:

• Configure, manage, and troubleshoot ACAS vulnerability scans, including scan policies, targets, credentials, schedules, and scan configurations across enterprise environments.
• Conduct authenticated and unauthenticated vulnerability scans across Windows, Linux, network, and other enterprise assets.
• Analyze and interpret ACAS scan results to identify, validate, and prioritize vulnerabilities based on severity, exploitability, asset criticality, and organizational risk.
• Investigate vulnerability findings and distinguish true positives from false positives through technical validation and analysis.
• Troubleshoot scan failures, credential issues, connectivity problems, and incomplete or inaccurate vulnerability results.
• Validate vulnerability remediation through follow-up scanning, configuration review, or other appropriate technical verification methods.
• Work with system owners, engineers, administrators, and other stakeholders to communicate vulnerability findings and coordinate remediation activities.
• Track vulnerabilities through the remediation lifecycle and ensure findings are addressed within established remediation timelines and service-level agreements.
• Develop and maintain vulnerability management reports, dashboards, metrics, and remediation status reports for technical teams and leadership.
• Support the management of vulnerability exceptions, risk acceptances, compensating controls, and remediation extensions in accordance with organizational policies.
• Correlate vulnerability findings with asset inventory, system ownership, configuration information, and security controls to improve the accuracy and effectiveness of remediation efforts.
• Apply vulnerability scoring and prioritization methodologies, including CVSS, CISA Known Exploited Vulnerabilities (KEV), vendor advisories, and threat intelligence, to support risk-based remediation decisions.
• Assess vulnerabilities and security configurations on Linux systems, including troubleshooting authenticated scans and supporting remediation activities.
• Support compliance and security assessment activities involving STIGs, DoD security requirements, vulnerability remediation requirements, and security baselines.
• Identify opportunities to improve vulnerability management processes through automation, scripting, workflow optimization, and integration with enterprise security technologies.

Qualifications:

Required:

• Active Top Secret/SCI security clearance.

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field; relevant cybersecurity experience may be substituted for the degree requirement.

• Minimum 5 years of relevant vulnerability management experience.

• DoD 8140/8570 IAT Level II certification, such as Security+ or equivalent.

• Demonstrated experience utilizing ACAS for vulnerability management, including scan configuration, vulnerability analysis, reporting, and remediation validation.

• Knowledge of enterprise security technology

What You Can Expect:

A culture of integrity.

At CACI, we place character and innovation at the center of everything we do. As a valued team member, you’ll be part of a high-performing group dedicated to our customer’s missions and driven by a higher purpose – to ensure the safety of our nation.

An environment of trust.

CACI values the unique contributions that every employee brings to our company and our customers - every day. You’ll have the autonomy to take the time you need through a unique flexible time off benefit and have access to robust learning resources to make your ambitions a reality.

A focus on continuous growth.

Together, we will advance our nation's most critical missions, build on our lengthy track record of business success, and find opportunities to break new ground — in your career and in our legacy.

Pay Range:

There are a host of factors that can influence final salary including, but not limited to, geographic location, Federal Government contract labor categories and contract wage rates, relevant prior work experience, specific skills and competencies, education, and certifications. Our employees value the flexibility at CACI that allows them to balance quality work and their personal lives. We offer competitive compensation, benefits and learning and development opportunities. Our broad and competitive mix of benefits options is designed to support and protect employees and their families. At CACI, you will receive comprehensive benefits such as; healthcare, wellness, financial, retirement, family support, continuing education, and time off benefits.

The proposed salary range for this position is:

$75,200-$158,100

CACI is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, age, national origin, disability, status as a protected veteran, or any other protected characteristic.