Endpoint Security Analyst 5515

Vulnerability Analysis & Prioritization: Review vulnerability reports, dashboards, and exposure data generated through CrowdStrike Falcon and related cybersecurity tools. Analyze open vulnerabilities affecting enterprise Windows, Linux, and MacOS workstations and servers. Validate vulnerability findings to determine affected systems, software versions, available patches, configuration changes, and other remediation options. Prioritize remediation based on:o CVSS severityo Active or known exploitationo CrowdStrike risk/exposure informationo Internet-facing exposureo Asset criticalityo Business impacto Age of the vulnerabilityo Established organizational OLAsIdentify vulnerabilities that require immediate escalation due to active exploitation or significant organizational risk. Distinguish between vulnerabilities requiring operating system patches, application updates, configuration changes, software removal, or compensating controls.

Vulnerability Remediation: Take direct ownership of assigned vulnerabilities from identification through successful remediation. Deploy and coordinate security patches for Windows workstations and servers, Linux servers, and MacOS devices. Remediate vulnerabilities associated with operating systems, browsers, third-party applications, utilities, drivers, and common enterprise software. Use Microsoft Intune, Azure Update Manager, SCCM, Patch My PC, PowerShell, and other enterprise management tools to deploy and automate remediation. Work with server administrators and infrastructure teams when remediation requires server patching, configuration changes, application upgrades, or maintenance windows. Troubleshoot failed patches and unsuccessful remediation attempts. Develop remediation solutions for vulnerabilities where traditional patching is not available. Remove or upgrade obsolete, unsupported, and vulnerable software when appropriate. Validate that remediation actions have successfully eliminated or mitigated the identified vulnerability. Ensure remediation activities minimize disruption to business operations.

OLA & Vulnerability Backlog Management: Monitor vulnerability aging and ensure assigned vulnerabilities are remediated within established OLAs. Maintain visibility into vulnerabilities approaching or exceeding OLA thresholds. Proactively escalate vulnerabilities that are at risk of missing remediation targets. Investigate vulnerabilities that remain open after remediation attempts and determine the root cause. Assist with reducing the organization's existing vulnerability backlog. Identify recurring vulnerabilities and recommend systemic solutions rather than repeatedly addressing individual systems. Track remediation progress and provide accurate status information to Cybersecurity and IT leadership. Support exception and risk-acceptance processes when vulnerabilities cannot be remediated within established timeframes.

Preferred Qualifications: Experience with CrowdStrike Falcon Exposure Management / Spotlight. Experience with Microsoft Intune Remediations. Experience automating software deployment and vulnerability remediation. Experience with enterprise server patching processes. Familiarity with vulnerability and security frameworks such as NIST, CIS Controls, and CISA Known Exploited Vulnerabilities (KEV).Experience working within an ITIL-based IT Service Management environment. Experience integrating vulnerability remediation with an ITSM platform. Security certifications such as Security+, CySA+, SSCP, GSEC, or equivalent are preferred but not required.

Key Competencies: The successful candidate should demonstrate:

• Ownership – Takes responsibility for vulnerabilities through verified closure rather than simply identifying or assigning issues.
• Technical Problem Solving – Can determine why a vulnerability exists and identify the most effective remediation.
• Automation Mindset – Looks for opportunities to remediate hundreds of systems rather than addressing devices individually.
• Risk Awareness – Understands that vulnerability severity alone does not determine business risk.
• Urgency – Recognizes when active exploitation or critical exposure requires accelerated remediation.
• Collaboration – Works effectively across Cybersecurity, Service Desk, Infrastructure, Endpoint Engineering, and application teams.
• Continuous Improvement – Identifies systemic improvements that prevent vulnerabilities from repeatedly returning.
• Measures of Success
• Performance for this position will be measured primarily by risk reduction and remediation effectiveness, including:
• Percentage of Critical and High vulnerabilities remediated within OLAReduction in vulnerability backlog
• Reduction in vulnerabilities exceeding OLAMean Time to Remediate (MTTR)
• First-attempt remediation success rate
• Reduction in recurring vulnerabilities
• Percentage of remediation activities automated
• Accuracy and completeness of remediation documentation
• Primary Objective
• Drive measurable reduction of cybersecurity risk by ensuring workstation and server vulnerabilities are prioritized, remediated, validated, and closed within established OLAs.