Continuous Diagnostics & Mitigation (CDM) Specialist / Vulnerability Management

Continuous Diagnostics & Mitigation (CDM) Specialist / Vulnerability Management

Location: Bethesda, MD (Hybrid; On-site as Required)

Clearance: Tier 2 Public Trust (Required)

Employment Type: Full-Time

Position Summary

Digital Global Connectors (DGC) is seeking an experienced Continuous Diagnostics & Mitigation (CDM) Specialist / Vulnerability Management to support a Federal information security program. This position provides technical leadership for enterprise Continuous Diagnostics and Mitigation (CDM) and Vulnerability Management programs by overseeing vulnerability identification, prioritization, remediation coordination, security configuration compliance, and enterprise cybersecurity metrics.

The CDM Specialist serves as a senior advisor for vulnerability management operations, working closely with ISSOs, Security Engineers, System Owners, Cloud Engineers, Security Operations Center (SOC) personnel, and program leadership to improve the organization's overall cybersecurity posture. The role provides strategic oversight of enterprise vulnerability management while ensuring compliance with Federal cybersecurity mandates, including FISMA, the NIST Risk Management Framework (RMF), CISA Binding Operational Directives (BODs), and applicable Federal security policies.

The successful candidate will possess extensive experience leading enterprise vulnerability management programs, implementing Continuous Diagnostics and Mitigation capabilities, and managing risk-based remediation activities across large Federal environments.

Essential Duties and Responsibilities:

Continuous Diagnostics and Mitigation (CDM) Program Leadership

• Lead implementation and continuous improvement of the organization's Continuous Diagnostics and Mitigation (CDM) program.
• Develop enterprise CDM strategies supporting organizational cybersecurity objectives.
• Oversee enterprise vulnerability management processes across on-premises, cloud, and hybrid environments.
• Ensure vulnerability management activities align with CISA CDM guidance and Federal cybersecurity initiatives.
• Establish operational procedures supporting continuous visibility into enterprise cybersecurity risk.
• Advise program leadership on CDM program maturity and strategic improvements.

Enterprise Vulnerability Management

• Direct enterprise vulnerability assessment activities across servers, workstations, network infrastructure, cloud services, applications, databases, and endpoint devices.
• Establish risk-based prioritization methodologies for vulnerability remediation.
• Review enterprise vulnerability trends and identify systemic security weaknesses.
• Coordinate remediation priorities with System Owners, ISSOs, and technical teams.
• Monitor enterprise remediation performance against organizational Service Level Agreements (SLAs).
• Ensure high-risk vulnerabilities receive immediate attention based on operational risk.

Vulnerability Assessment Oversight

Provide oversight of enterprise assessment activities utilizing technologies such as:

• Tenable Security Center
• Nessus Manager
• Nessus Professional
• Nessus Agents
• Microsoft Defender Vulnerability Management
• Qualys VMDR
• Rapid7 InsightVM
• Microsoft Defender for Cloud
• AWS Inspector
• Azure Security Center
• CISA Known Exploited Vulnerabilities (KEV) Catalog

Ensure vulnerability assessments are comprehensive, accurate, and aligned with organizational operational requirements.

Security Configuration Compliance

• Oversee enterprise compliance with DISA Security Technical Implementation Guides (STIGs), CIS Benchmarks, Microsoft Security Baselines, and organizational configuration standards.
• Review security configuration assessment results.
• Recommend enterprise configuration improvements.
• Coordinate remediation of configuration compliance findings.
• Support secure baseline implementation across enterprise technologies.

Risk Management Framework (RMF) Support

• Support implementation of NIST SP 800-53 security controls related to vulnerability management and continuous monitoring.
• Coordinate vulnerability remediation supporting Authorization to Operate (ATO) packages.
• Assist Security Assessors during Security Control Assessments (SCAs).
• Validate remediation of technical findings affecting authorized systems.
• Support continuous monitoring reporting for Government leadership.

Enterprise Reporting and Metrics

Develop executive reporting including:

• Enterprise Vulnerability Dashboards
• Executive Risk Reports
• Remediation Metrics
• Security Scorecards
• Vulnerability Trend Analysis
• POA&M Status Reports
• Continuous Monitoring Metrics
• CDM Performance Reports
• CISA Reporting
• Executive Briefings

Present cybersecurity metrics to executive leadership and recommend strategic improvements.

Governance and Stakeholder Coordination

• Collaborate with ISSOs, Security Engineers, Security Architects, Cloud Engineers, SOC Analysts, Threat Hunters, System Owners, and Government leadership.
• Chair enterprise vulnerability review meetings.
• Coordinate cross-functional remediation activities.
• Provide technical guidance regarding vulnerability prioritization and remediation strategies.
• Support cybersecurity governance boards and executive working groups.

Continuous Improvement

• Evaluate emerging vulnerability management technologies and CDM capabilities.
• Recommend improvements to enterprise vulnerability management processes.
• Monitor evolving Federal cybersecurity requirements and incorporate them into CDM operations.
• Support automation initiatives that improve vulnerability identification, reporting, and remediation.
• Mentor junior cybersecurity personnel and promote best practices across the organization.

Minimum Qualifications

• Bachelor's degree in Cybersecurity, Information Assurance, Computer Science, Information Technology, Engineering, or a related discipline.
• Minimum seven (7) years of experience leading enterprise vulnerability management or Continuous Diagnostics and Mitigation (CDM) programs.
• Experience administering enterprise vulnerability management platforms such as Tenable, Qualys, Rapid7, or Microsoft Defender Vulnerability Management.
• Experience supporting Federal cybersecurity programs implementing FISMA and NIST RMF requirements.
• Experience leading cross-functional remediation efforts involving multiple technical organizations.
• Strong leadership, analytical, organizational, and communication skills.
• U.S. Citizenship required.
• Ability to obtain and maintain a Tier 2 Public Trust.

Preferred Qualifications

• Master's degree in Cybersecurity, Information Assurance, Computer Science, Engineering, or a related discipline.
• Experience supporting a Federal civilian agency.
• Experience implementing CISA Continuous Diagnostics and Mitigation (CDM) initiatives.
• Experience supporting Microsoft Azure, AWS, and hybrid cloud environments.
• Experience leading enterprise cybersecurity metrics and executive reporting programs.
• Tenable Certified Nessus Expert
• CompTIA CySA+
• Certified Information Systems Security Professional (CISSP)
• Certified Authorization Professional (CAP)
• GIAC Continuous Monitoring Certification (GMON)
• Microsoft Certified: Azure Security Engineer Associate (AZ-500) (preferred)

Knowledge, Skills, and Abilities

• Continuous Diagnostics and Mitigation (CDM)
• Enterprise Vulnerability Management
• Risk-Based Vulnerability Prioritization
• Vulnerability Analytics
• Tenable Security Center
• Nessus
• Microsoft Defender Vulnerability Management
• Qualys VMDR
• Rapid7 InsightVM
• Microsoft Defender for Cloud
• AWS Inspector
• Security Configuration Compliance
• DISA STIGs
• CIS Benchmarks
• NIST Risk Management Framework (RMF)
• NIST SP 800-53
• Federal Information Security Modernization Act (FISMA)
• CISA Binding Operational Directives (BODs)
• Executive Cybersecurity Reporting
• Dashboard Development
• Microsoft Power BI
• ServiceNow
• Jira
• Technical Leadership
• Cross-Functional Program Management

Security Requirements

• Ability to successfully obtain and maintain a Tier 2 Public Trust investigation.
• Compliance with all applicable Federal security, privacy, ethics, and information assurance training requirements before receiving system access.
• Ability to support enterprise cybersecurity operations, emergency vulnerability response activities, scheduled maintenance windows, continuity of operations (COOP), and surge support as required.
• Must maintain strict confidentiality while handling sensitive vulnerability information, enterprise security metrics, and Federal information systems.
• Ability to lead enterprise vulnerability management initiatives, communicate cybersecurity risk to executive leadership, and drive continuous improvement across the organization's cybersecurity program while ensuring compliance with Federal security requirements.