[Remote] Senior Vulnerability Analyst (US)

Note: The job is a remote job and is open to candidates in USA. VulnCheck is an exploit intelligence company delivering structured intelligence on vulnerabilities actively weaponized in the wild. The Senior Vulnerability Analyst will assess and validate vulnerability reports, coordinate disclosures with suppliers and researchers, publish CVE and advisory data, and improve vulnerability triage and reporting workflows.

Responsibilities

• Assess vulnerability reports submitted through VulnCheck’s [Report a Vulnerability](https://www.vulncheck.com/advisories/report) service for overall validity and CVE eligibility
• Conduct vulnerability disclosure conversations with software suppliers, security researchers (vulnerability reporters), and standards communities, guiding all parties toward mutually beneficial outcomes
• Where needed, follow CNA Operational Rules for submitting disputes or conducting escalations to get CVE records assigned and published appropriately (e.g., by following formal dispute processes)
• Populate CVE metadata accurately, including calculating correct CVSS scores, assigning CWEs, and mapping discovered vulnerabilities to MITRE ATT&CK techniques and CAPEC attack patterns
• Develop and refine workflows and playbooks for vulnerability triage, mapping, and reporting; track key metrics across CVD and CVE publication caseloadsg
• Share your expertise and perspective on vulnerability disclosure with internal teams, VulnCheck customers, and the broader vulnerability research community

Skills

• We're looking for a Senior Vulnerability Analyst with hands-on experience conducting coordinated vulnerability disclosure (CVD) and publishing CVEs to join VulnCheck's CNA team
• 2+ years of coordinated vulnerability disclosure (CVD) experience at a PSIRT, government agency, researcher or bug bounty CNA, or other coordinating body in the vulnerability disclosure ecosystem
• Prior experience writing, reviewing, and updating CVE records; familiarity with CVE record structure and tooling (e.g., CVE services, Vulnogram)
• Prior experience analyzing unstructured vulnerability reports and product documentation to determine whether reported issues cross security boundaries and demonstrate sufficient impact to confidentiality, integrity, and availability
• Prior experience reporting and coordinating vulnerability reports with third-party organizations, including commercial and open-source projects and products
• Exceptionally strong written and verbal communication skills: You will use these every day to translate technical concepts to different audiences, often across different languages and levels of vulnerability disclosure understanding
• Knowledge of MITRE ATT&CK, CAPEC, and CWE, and working experience mapping vulnerability reports to these frameworks
• Advanced understanding of CVSS (v3 and v4), including real-world application to vulnerability scoring and risk communication
• Strong analytical, technical, and research skills, with a passion for data quality and process rigor
• Experience engaging with community initiatives, standards bodies, or open-source projects in the vulnerability or threat intelligence space
• Familiarity with automation tools or programming/scripting languages (Python, Golang, etc.) for data enrichment or workflow improvement
• Published research, whitepapers, or presentations in the field of vulnerability analysis, mapping, or threat intelligence

Benefits

• Unlimited PTO
• 401k plan with company match
• Comprehensive healthcare coverage
• Generous paid parental leave
• Remote friendly environment with flexibility
• Expense reimbursement for Cell Phone & Internet
• Ongoing professional development, coaching, and learning resources
• Opportunities for career advancement within a fast-growing team

Company Overview