Qualys Engineering Analyst

The Qualys Engineering Analyst will own the end‑to‑end vulnerability management lifecycle, partnering with infrastructure, network, firewall, hypervisor, server, and application teams. You will drive scanning, analysis, reporting, and remediation governance while delivering actionable metrics and ensuring alignment with industry frameworks such as SANS, OWASP, and MITRE ATT&CK. Interact regularly with IT, InfoSec managers, engineers, and developers to coordinate vulnerability activities.

Provide governance and operational support for vulnerability remediation processes.

Generate and deliver ad‑hoc and scheduled vulnerability metrics reports for key performance indicators.

Drive remediation initiatives and track progress across multiple support teams.

Respond to stakeholder inquiries regarding assessment results and remediation actions.

Collaborate with network, firewall, hypervisor, server, and application teams on identified vulnerabilities.

Conduct vulnerability scans using Qualys and other tools, ensuring coverage of on‑prem and cloud assets.

Analyze vulnerability data using advanced Excel techniques to identify trends and risk exposure.

Maintain alignment with SANS Top 25, OWASP Top 10, and MITRE ATT&CK frameworks.

Document remediation procedures and contribute to continuous improvement of the vulnerability management program.

Bachelor’s degree in Computer Science, Cybersecurity, or related field, or equivalent experience.

5–8 years of combined IT and security experience, including 3+ years in vulnerability management.

Proven expertise with Qualys vulnerability scanning platform.

Hands‑on experience with additional tools such as Armis, Microsoft Defender for Endpoint/Cloud.

Advanced Microsoft Excel skills for data analysis and reporting.

Familiarity with SANS Top 25 controls, OWASP Top 10, and MITRE ATT&CK framework.

Strong understanding of cloud architectures, services, and associated vulnerabilities.

Ability to interpret and communicate complex vulnerability data to technical and non‑technical audiences.

Knowledge of risk assessment methodologies and remediation governance.

Excellent written and verbal communication skills.