Vulnerability Management Analyst (Cybersecurity)

Location: Hybrid, requiring in-office presence at least one day per week in Boston, Chicago, or Dallas, United States

Annual full-time salary: $67,000–$80,000 in Boston; $64,000–$77,000 in Chicago; $61,000–$73,000 in Dallas, plus discretionary performance bonus.

Company

Bain & Company is a global consulting firm with a Technology Services Group supporting enterprise technology and cyber operations.

What you will do

• Own and improve the end-to-end vulnerability management lifecycle, including asset discovery, scanning, validation, prioritization, remediation governance, rescanning, and closure verification.
• Administer and tune Qualys VMDR, Wiz, and Tanium, including deployments, integrations, reporting, and scanner, agent, and sensor health.
• Lead the CTEM program and consolidate findings into a single risk-ranked view of enterprise exposure.
• Prioritize vulnerabilities using CVSS, EPSS, CISA KEV, threat intelligence, and business criticality.
• Set remediation SLAs, manage exceptions and risk acceptance, and drive accountability with IT, infrastructure, cloud, and engineering teams.
• Build exposure dashboards and executive reporting, mentor junior analysts, and communicate risks and hardening recommendations to technical and senior stakeholders.

Requirements

• 3–5 years of hands-on experience in vulnerability management, exposure management, or related security operations, including lead-capacity experience.
• Deep understanding of vulnerability management lifecycle, risk-based remediation, and SLA governance in large, complex environments.
• Hands-on experience with all three required platforms: Qualys VMDR, Wiz, and Tanium.
• Demonstrated experience running or materially contributing to a CTEM program, including scoping, discovery, prioritization, validation, and mobilization.
• Proficiency in CVSS, EPSS, CISA KEV, and threat-intelligence-driven prioritization.
• Strong reporting and analytical skills using Excel, pivot tables, native security-tool reporting, and executive-level metrics.
• Experience securing Windows, Linux, network devices, endpoints, containers, and multi-cloud workloads.
• Strong understanding of threat intelligence and the ability to correlate external threats with internal findings.
• Excellent written, verbal, and presentation skills; ability to influence stakeholders, communicate risks to leadership, and mentor junior analysts.
• Advanced English proficiency for professional and technical communication.

Nice to have

• Knowledge of CSPM, CNAPP, and container or Kubernetes security, ideally with Wiz or equivalent technologies.
• Familiarity with CIS Benchmarks, secure configuration practices, and system hardening standards.
• Experience with Python, PowerShell, tool APIs, or Power Query automation.
• Experience integrating vulnerability management tools with IT service management platforms such as ServiceNow.
• Qualys VMDR, Wiz, GIAC, CEH, CISSP, Tanium, or CompTIA Security+ certification, or progress toward certification.

Culture & Benefits

• Permanent full-time employment in a hybrid model with at least one office day per week.
• Annual discretionary performance bonus and a 4.5% 401(k) company contribution that increases after three years; contribution is fully vested at start.
• Bain pays 100% of individual employee medical, dental, and vision premiums.
• Paid time off including parental leave, sick leave, and paid holidays.
• Paid life and long-term disability insurance plus annual fitness reimbursements.