Careers | Dragonfli Group — Senior Talent Only.

Security Operations (SecOps)

Vulnerability Management Analyst

Role Summary

The Senior Vulnerability Management Analyst will own and operate vulnerability management programs for a large federal client. This is a delivery-oriented role with direct program accountability. The analyst will lead scanning operations, manage attack surface reduction programs, maintain stakeholder relationships, and drive remediation to closure. The right candidate can manage ambiguity, produce results with minimal supervision, and operate across technical and program management workstreams simultaneously.

Responsibilities

Program Ownership

Lead and manage end-to-end vulnerability disclosure programs (VDP), including coordination with ethical hackers, system owners, and agency stakeholders.
Own attack surface management programs (e.g., CISA FAST), including scheduling, scope management, findings coordination, and POA&M documentation.
Manage and update Standard Operating Procedures (SOPs), SharePoint repositories, and program tracking documentation.
Lead recurring stakeholder syncs (weekly vulnerability management meetings, DMZ syncs, Security Report presentations).

Scanning and Technical Execution

Operate and maintain enterprise vulnerability scanning platforms including Tenable.sc, Tenable.io, and web application scanning tools (OpenText ScanCentral or equivalent).
Scope, schedule, execute, and report on vulnerability scans across large, complex federal environments.
Analyze scan results to identify critical and high-severity findings; triage false positives; prioritize remediation activities.
Manage hardware/software certification pipelines; process ServiceNow tickets within defined SLAs.
Support transition from legacy tools to modernized scanning platforms with minimal operational disruption.

Remediation and Risk Management

Track and drive remediation of critical, high, and all severity-tiered vulnerabilities to closure within program SLAs.
Maintain accurate POA&M records for all open findings across program scope.
Produce and present vulnerability dashboards, compliance reports, and executive-level status briefings.
Validate remediation effectiveness through post-remediation scanning and analysis.
Monitor HTTPS/HSTS compliance and other BOD requirements (BOD 18-01, BOD 20-01, and others as applicable).

Stakeholder Engagement

Build and maintain working relationships with CISA contacts, agency system owners, SOC personnel, and contractor teams.
Communicate vulnerability risks and remediation recommendations clearly to both technical and non-technical audiences.
Serve as subject matter expert and primary point of contact for assigned programs.
Provide backfill coverage across vulnerability management workstreams as needed.

Requirements

Must-Have:

Experience operating WebInspect, OpenText ScanCentral, or equivalent DAST/web application scanning tools.
Familiarity with Bugcrowd or other managed bug bounty platforms.
Experience with HSTS/HTTPS compliance monitoring aligned to BOD 18-01.
Active certifications: Security+, CEH, CISSP, CISM, or Certified Vulnerability Assessor (CVA).
Experience leading or co-leading standing meetings with federal stakeholders.

Preferred:

3+ years of hands-on vulnerability management experience within a federal agency environment.
Demonstrated program ownership: VDP, attack surface management, or equivalent independently managed programs.
Proficiency with Tenable.sc and/or Tenable.io (scan configuration, report generation, false positive management).
Experience with CISA programs (VDP, FAST, BOD compliance) or equivalent federal cybersecurity initiatives.
Working knowledge of ServiceNow or equivalent ITSM platforms for ticket management.
Ability to produce clean, accurate SOPs, POA&Ms, and stakeholder-facing documentation.
Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or equivalent practical experience.
Active security clearance or eligibility to obtain one preferred.

Skills

Program Ownership
Scanning and Technical Execution
Remediation and Risk Management
Stakeholder Engagement

EEO Statement

Dragonfli Group LLC is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability, veteran status, sexual orientation, gender identity, or any other characteristic protected by applicable law.

Apply on LinkedIn

Apply on Dragonfli

Threat Detection & Security Operations

NERC CIP Virtualization Consultant

Role Summary

‍
We are seeking an experienced NERC CIP Virtualization Consultant to support a large commercial enterprise in the energy sector on a critical compliance initiative. This role focuses on developing, updating, and socializing policies and procedures that bring virtualized Bulk Electric System (BES) Cyber Systems into full alignment with NERC Critical Infrastructure Protection (CIP) standards — specifically in the context of NERC Project 2016-02 (Modifications to CIP Standards for Virtualization). The ideal candidate brings 5–8 years of hands-on experience in NERC CIP compliance, a strong grasp of virtualization technologies as they apply to OT/ICS environments, and the communication skills to translate complex regulatory requirements into actionable, organization-wide guidance. This is a remote-first position.

This is a contract position involving a large commercial enterprise in the energy sector. Candidates with previous consulting or contracting experience are preferred. U.S. Citizenship or Permanent Residency is required. Drug screening and background investigations will be required. If hired, all work related to this role must be performed within the continental U.S.

‍

Responsibilities

Review and update existing NERC CIP policies and procedures to reflect virtualization requirements under NERC Project 2016-02
Develop new documentation for in-scope BES Cyber Systems across all project phases including design, build, and delivery
Document technical and procedural requirements for virtualized environments supporting critical infrastructure
Develop testing and evidence collection strategies to support CIP compliance audits
Update Management Model documentation to reflect changes in processes and procedures
Conduct awareness and education sessions to drive organizational understanding of CIP virtualization changes
Leverage assessment tools such as Tripwire or AssurX to support gap analysis and ongoing compliance monitoring
Collaborate with internal stakeholders across IT, OT, and compliance functions to socialize policy changes
Serve as a subject matter expert on NERC CIP standards, providing technical and regulatory guidance to project teams
Support engagement planning, analysis, and stakeholder coordination throughout all project phases

‍

Requirements:

Must-Have:

5+ years of experience with NERC Critical Infrastructure Protection (CIP) standards in an energy, utilities, or electric reliability context
Demonstrated experience with virtualization technologies (e.g., VMware, Hyper-V, or equivalent) as applied to OT/ICS or BES Cyber Systems
Experience developing, updating, and implementing cybersecurity policies and procedures in a regulated utility or energy environment
Familiarity with NERC Project 2016-02 (Modifications to CIP Standards) and the regulatory context for CIP virtualization
Ability to communicate complex technical and regulatory concepts to non-technical stakeholders
Experience conducting or supporting NERC CIP compliance assessments, audits, or gap analyses
Proficiency producing professional deliverables in Microsoft Word, PowerPoint, and Excel
U.S. Citizenship or Permanent Residency (required per contract)
Ability to work within the continental United States for the duration of the engagement

Preferred / Nice-to-Have:

Experience with Tripwire Enterprise or AssurX Quality Management/Regulatory Compliance software in a NERC CIP context
Prior consulting or subcontracting experience in a multi-stakeholder energy sector engagement
NERC CIP certification or formal NERC compliance training (e.g., through SERC, WECC, or NERC University)
Familiarity with the BES Cyber System categorization process and associated protection requirements
Experience with evidence collection and audit readiness for NERC CIP regional entity reviews
Working knowledge of OT/SCADA environments and their intersection with CIP virtualization standards
Prior experience transitioning from short-term compliance engagements to long-term regulatory support roles

Skills

Technical Skills:

NERC CIP Standards (CIP-002 through CIP-014, with focus on virtualization-applicable standards)
Virtualization technologies: VMware vSphere, Hyper-V, or equivalent hypervisor platforms
OT/ICS and BES Cyber System environments
Policy and procedure development for regulatory compliance
Cybersecurity assessment and gap analysis methodologies
Tripwire Enterprise (file integrity monitoring and configuration management)
AssurX quality management and regulatory compliance tracking
Evidence collection and audit documentation for NERC CIP
Microsoft Office Suite (Word, PowerPoint, Excel) for regulatory deliverables

Soft Skills:

Ability to socialize complex compliance changes across technical and non-technical stakeholder groups
Strong written communication skills for producing regulatory-quality documentation
Organizational awareness — ability to navigate large, matrixed utility organizations
Self-directed with the discipline to manage deliverables in a remote-first environment
Collaborative approach to cross-functional policy development and implementation
Adaptability to transition from short-term compliance delivery to a long-term program support role

EEO Statement

Apply on LinkedIn

Apply on Dragonfli

We don't hire for roles. We hire for impact.

We Only Hire the Best. Are You?

Where your impact starts.

Security Engineering & Architecture

Security Operations (SecOps)

Threat Detection & Security Operations

Governance, Risk, & Compliance (GRC)

Data Security & Privacy

Identity & Access Management (IAM)

OT / ICS Security

Data Science & AI

Program Management & Strategy

What Happens After You Submit.