Vulnerability Analyst

About the role

The is responsible for transforming intricate security requirements into structured and comprehensive testing programs tailored for critical client environments. In this capacity, the hire functions as the primary technical architect for assessment initiatives, overseeing the complete lifecycle of security findings from initial discovery through final remediation validation. Success in this role demands a disciplined and methodical approach to defining testing boundaries, executing evaluation modules, and steering stakeholders toward sustainable security outcomes. The position operates predominantly within the United States while engaging with a wide array of global sectors and diverse regulatory frameworks.

Key facts

What you'll do

• Design intake procedures that map customer infrastructure and establish the scope of testing activities before any active assessment begins.
• Translate ambiguous and high-level requirements into concrete, actionable testing methodologies that address current threat landscapes and organizational risk postures.
• Construct assessment modules using specialized scripts and tools to examine system configurations, authentication mechanisms, and communication pathways.
• Examine resulting data to confirm risk classifications, assess business context, and determine the clarity of technical guidance provided to engineering teams.
• Coordinate directly with client personnel to validate findings, ensuring proof of concept evidence operates within their operational constraints and business continuity requirements.
• Guide remediation efforts by updating technical documentation, revisiting test logic, and verifying that security fixes perform as intended without introducing new weaknesses or regressions.
• Maintain current awareness of new attack patterns, emerging cloud services, and third-party products that continuously alter the testing surface and client environments.
• Shape reporting narratives that explain not only how issues were discovered, but why they matter and how they connect directly to organizational business impact and risk.
• Support partner initiatives by providing technical context, sharing established methodologies, and aligning deliverables with external stakeholder expectations and project goals.
• Conduct manual verification procedures to confirm the existence and severity of identified vulnerabilities beyond what automated tools can detect.
• Assess authentication mechanisms and session management schemes to identify weaknesses in identity and access controls.
• Evaluate system configurations against established benchmarks and security best practices to identify insecure settings.
• Analyze communication pathways and network architectures to uncover potential data exposure or lateral movement risks.
• Collaborate with other security professionals to integrate vulnerability findings into broader assessment reports and executive summaries.
• Ensure all testing activities adhere to the defined scope and rules of engagement to maintain the integrity of the assessment process.

Requirements

Holding active security clearances that permit work on United States government contracts and projects is mandatory for this role. Candidates must demonstrate three years of hands-on experience with security assessments, vulnerability scanning programs, and manual verification procedures. A strong understanding of common web and API weaknesses is required so that testing activities address realistic threat scenarios and adversarial techniques. Effective communication skills in English are essential, both in written documentation and verbal discussions with technical and non-technical stakeholders across organizational levels. You must be able to work within the United States and comply with all federal contractor eligibility requirements. The ability to obtain and maintain the necessary clearances is a non-negotiable condition of employment for this position.

Nice to have

Experience with major cloud platforms, container orchestration systems, or infrastructure as code tools is preferred when relevant to specific assessment engagements. Familiarity with these technologies enables more effective evaluation of modern infrastructure configurations and deployment patterns.

About the company

Coalfire is on a mission to make the world a safer place by solving our clients' hardest cybersecurity challenges. We work at the cutting edge of technology to advise, assess, automate, and ultimately help companies navigate the ever-changing cybersecurity landscape. We are headquartered in Chicago, Illinois with offices across the United States.