Vulnerability Patch Management Analyst

A client of ours has a need for a Vulnerability Patch Management Analyst for their Midtown Manhattan office in NYC. This position is a contract hybrid role with 3 days a week in the office.ONLY W2, must be a US citizen or GC Holder. NO vendors.Key ResponsibilitiesVulnerability & Patch ManagementManage the end-to-end vulnerability and patch management lifecycle, including identification, assessment, prioritization, remediation, and validation across infrastructure, applications, systems, network devices, and the software development lifecycle (SDLC).Develop and implement risk-based remediation strategies that align vulnerability severity, business impact, and established remediation SLAs.Monitor remediation progress, identify SLA breaches, maintain Plans of Action and Milestones (POA&Ms), and drive follow-up actions with responsible IT teams.Coordinate with IT teams to obtain, test, and deploy vendor patches and security updates in a timely manner.Assess vulnerability exposure and treatment options to ensure remediation efforts are focused on the most critical risks.Develop, maintain, and enhance VPM policies, procedures, process documentation, playbooks, and runbooks.Establish and maintain a comprehensive patch management strategy, strengthening governance, accountability, and operational effectiveness.Cybersecurity Monitoring & Incident ResponseAnalyze security event data, SIEM alerts, and other relevant data sources to identify indicators of attack, suspicious activity, and potential security breaches.Produce incident reports, support incident coordination, and collaborate with cybersecurity defense teams to facilitate timely investigation and response.Coordinate with defense teams to ensure security monitoring tools and systems remain operational, current, and effective.Provide backup support for cybersecurity incidents, projects, and audit remediation activities, including off-hours support when required.Risk, Governance & ComplianceEvaluate vulnerability and patch management effectiveness, ensuring alignment with internal policies, security standards, regulatory expectations, and industry best practices.Collaborate with the Second Line of Defense (2LOD), IT Risk, Compliance, and internal and external auditors to support control assessments, audit requests, and remediation activities.Support vulnerability assessments, track system and software updates, and strengthen adherence to approved security tools and processes.Stay informed of emerging threats, industry trends, and evolving cybersecurity requirements to recommend continuous program improvements.Reporting, Analytics & Program EnhancementDevelop, maintain, and present key performance indicators (KPIs), key risk indicators (KRIs), dashboards, and management reports that provide clear visibility into vulnerability exposure, remediation progress, SLA performance, and program effectiveness.Deliver accurate, consistent, and actionable reporting to senior management, technology stakeholders, and cybersecurity leadership.Use data analytics, advanced Excel, Power Query, Power BI, scripting, and AI-enabled automation to streamline manual processes, improve data quality, and enhance operational efficiency.Translate complex technical findings into clear, actionable insights and strategic recommendations for stakeholders.Lead initiatives to improve the Americas CIB Vulnerability & Patch Management program through enhanced processes, reporting, automation, and risk-based decision-making.Required Qualifications & Technical SkillsExperience: 5–9 years of relevant experience in vulnerability management, patch management, cybersecurity operations, IT risk, or a related information security role.Vulnerability & Patch Management: Demonstrated experience managing vulnerability identification, scanning, risk assessment, remediation tracking, patch deployment, SLA monitoring, and POA&Ms.Security Monitoring: Hands-on experience with Security Information and Event Management (SIEM) tools, including alert analysis, dashboard development, and security reporting.Vulnerability Management Tools: Experience conducting vulnerability scans, assessing findings, coordinating remediation, and validating treatment outcomes.Data Analytics & Reporting: Strong proficiency in Power BI, advanced Excel, Power Query, data analysis, pivot tables, and the development of management reporting and dashboards.Automation & Scripting: Experience with scripting and an ability to apply AI tools and automation techniques to streamline repetitive tasks and improve processes.Infrastructure & Networking: Strong understanding of network devices and architecture, TCP/IP, network protocols, server operating systems, and vulnerability scanning technologies.Operating Systems & Technologies: Familiarity with Windows, Linux/Unix, VMware, intrusion detection and prevention technologies (IDS/IPS), and digital forensic discovery concepts.Security Frameworks & Controls: Knowledge of cybersecurity and IT audit frameworks and standards, including NIST Cybersecurity Framework (CSF), ISO 27001, CIS Controls, and FFIEC guidance.Governance & Documentation: Understanding of internal controls, security policies, audit requirements, and the development and maintenance of procedures, process manuals, playbooks, and runbooks.Communication & Collaboration: Strong analytical, interpersonal, and communication skills, with the ability to present technical findings and recommendations to management and collaborate effectively across geographically distributed teams.Education & Preferred CertificationsBachelor's degree in Information Assurance, Information Security, Computer Science, or a related field, or equivalent professional experience.Relevant certifications are preferred but not required, including:CISSP – Certified Information Systems Security ProfessionalCISM – Certified Information Security ManagerGCIH – GIAC Certified Incident HandlerGCIA – GIAC Certified Intrusion AnalystGPEN – GIAC Penetration Tester