Senior Vulnerability Analyst

You will analyze and map discovered vulnerabilities to MITRE ATT&CK techniques and CAPEC attack patterns with precision and consistency. You will determine and assign accurate CWE IDs with well-documented rationales, and authoritatively calculate CVSS v3/v4 base scores with transparent, defensible justifications. You will review, draft, and curate CVE Records, ensuring data quality and consistency with CVE Program standards. You will liaise with vulnerability researchers, product security teams, and standards communities to ensure best practices and knowledge transfer. You will develop and refine workflows and playbooks for vulnerability triage, mapping, and reporting, and you will share your expertise by mentoring junior analysts and driving team knowledge-sharing initiatives.

Responsibilities

• Analyze and map discovered vulnerabilities to MITRE ATT&CK techniques and CAPEC attack patterns
• Determine and assign accurate CWE IDs with well-documented rationales
• Calculate CVSS v3/v4 base scores with transparent, defensible justifications
• Review, draft, and curate CVE Records ensuring data quality and consistency with CVE Program standards
• Liaise with vulnerability researchers, product security teams, and standards communities
• Develop and refine workflows and playbooks for vulnerability triage, mapping, and reporting
• Mentor junior analysts and drive team knowledge-sharing initiatives

Requirements

• Proven experience with the CVE Program as an analyst, CNA, or significant contributor
• Expert knowledge of MITRE ATT&CK, CAPEC, and CWE with experience mapping vulnerabilities to these frameworks
• Advanced understanding of CVSS v3 and v4 including real-world vulnerability scoring and risk communication
• Strong analytical, technical, and research skills
• Exceptional written and verbal communication skills
• Experience engaging with community initiatives, standards bodies, or open-source projects in vulnerability or threat intelligence is highly desirable
• Experience contributing to vulnerability standards such as CVE Editorial Boards or CAPEC Working Groups is preferred
• Familiarity with automation tools or programming languages such as Python or Golang is preferred
• Published research, whitepapers, or presentations in vulnerability analysis or threat intelligence is preferred

Benefits

• Unlimited PTO
• 401k plan with company match
• Comprehensive healthcare coverage
• Generous paid parental leave
• Remote friendly environment with flexibility
• Expense reimbursement for cell phone and internet
• Ongoing professional development, coaching, and learning resources