> Markdown version of [/jobs/ext/4182094-remote-cyber-vulnerability-assessment-analyst-senior-cyber-security](https://www.wearedevelopers.com/jobs/ext/4182094-remote-cyber-vulnerability-assessment-analyst-senior-cyber-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# (Remote) Cyber Vulnerability Assessment Analyst Senior - Cyber Security

- **Company:** Penn State Health
- **Location:** United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Software System Penetration Testing, Cloud Computing Security, Cyber Security, Software Vulnerability Management, Enterprise Software Applications, Mitre Att&ck, Cyber Threat Analysis, Information Technology, Vulnerability Analysis
- **Published:** October 12, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=262d4e3b17e88663

## About the Role

* Bachelor's Degree plus five (5) years of related experience, or an equivalent combination of education and experience., * Degree in a Cyber Security, Computer Science, or Information Technology or related discipline.
 * Experience with vulnerability management, exposure management, attack-surface management, cloud security, threat intelligence, security operations, or penetration testing.
 * Relevant cybersecurity or information technology certification.

## Description

Performs cybersecurity vulnerability and exposure assessments across enterprise systems, applications, cloud platforms, identities, networks, and externally facing assets. Identifies, analyzes, prioritizes, and validates vulnerabilities, security weaknesses, attack-surface exposures, and control gaps to support measurable risk reduction. This senior-level position operates under minimal direction and provides mentoring and technical guidance to less experienced analysts.

Essential Functions

 1. Assess and map enterprise exposure - evaluate vulnerabilities, misconfigurations, control gaps, and attack paths across infrastructure, applications, cloud platforms, identities, externally facing assets, and emerging AI systems and integrations.

 2. Drive threat-informed prioritization - apply adversary intelligence, MITRE ATT&CK-mapped techniques, exploitability data, asset criticality, and business context to focus exposure reduction where it matters most.

 3. Deliver clear findings and remediation guidance - conduct exposure analysis, produce actionable recommendations, and partner with asset owners and technology teams to drive measurable exposure reduction.

 4. Evaluate control effectiveness - assess whether existing controls adequately address identified exposures; apply MITRE D3FEND to identify and evaluate compensating or mitigating controls, and validate that control decisions reduce exposure as intended.

 5. Partner with the threat intelligence team - monitor adversary activity, emerging exposures, frontier AI-enabled threats, and industry developments; align exposure prioritization with MITRE ATT&CK-mapped adversary targeting and active campaigns to ensure remediation sequencing reflects realistic threat context; provide technical mentoring to developing analysts.