Vulnerability Analyst 2

Job Summary:

The vulnerability analyst is a key member of the vulnerability & threat management team responsible for identifying, analyzing, prioritizing, and driving remediation of security vulnerabilities across Sysco's global technology environment. This role partners closely with infrastructure, cloud, application, and security teams to reduce organizational cyber risk through proactive vulnerability management, asset discovery, threat analysis, and continuous improvement of security controls.

The ideal candidate will have experience in vulnerability management processes, security tools, remediation coordination, and risk-based prioritization. This position requires strong analytical skills, technical knowledge, and the ability to collaborate effectively with stakeholders across the enterprise.

Duties and Responsibilities:

• Conduct vulnerability assessments across on-premises, cloud, network, endpoint, and application environments using enterprise security tools.

• Analyze vulnerability scan results, validate findings, and assess business risk to support remediation prioritization.

• Monitor and evaluate emerging threats, vulnerabilities, exploit trends, and security advisories to determine organizational impact.

• Partner with infrastructure, cloud, application, and business teams to drive timely remediation of identified vulnerabilities.

• Track remediation efforts and provide reporting on vulnerability trends, risk reduction, SLAs, and key program metrics.

• Collaborate with technology teams to identify and decommission end-of-life (EOL) and unsupported systems that create security risk.

• Perform asset discovery activities and leverage reconnaissance tools to identify unknown, rogue, internet-facing, and newly discovered assets.

• Configure, maintain, and optimize vulnerability scanning and discovery platforms to ensure accurate visibility and coverage.

• Analyze security logs, scan data, and threat intelligence sources to identify potential security exposures and attack vectors.

• Assist with vulnerability exception reviews and risk acceptance processes, ensuring appropriate documentation and risk justification.

• Support incident response and threat hunting activities by providing vulnerability context and exposure analysis when needed.

• Develop and maintain vulnerability management documentation, procedures, standards, and operational runbooks.

• Participate in continuous improvement initiatives focused on enhancing vulnerability management effectiveness, automation, and reporting.

• Work closely with threat intelligence and security operations teams to identify vulnerabilities actively targeted by threat actors and prioritize response efforts.

• Provide guidance and best practices to technology teams regarding vulnerability

Education Required:

• Security Certification

• Bachelor’s degree in computer science, business administration, information systems, or a related field, or equivalent work experience.

Experience Required:

• 3-5 years of experience in cybersecurity, vulnerability management, security operations, or a related information security discipline.

• Experience working with enterprise vulnerability management platforms such as Tenable, Qualys, Wiz, Sentinal1 or similar technologies.

• Strong understanding of vulnerability management frameworks, CVSS scoring, risk-based prioritization, and remediation workflows.

• Knowledge of operating systems, networking concepts, cloud technologies, and common security architectures.

• Experience interpreting vulnerability scan results and communicating technical findings to both technical and non-technical stakeholders.

• Familiarity with security monitoring, log analysis, and security event investigation.

• Understanding of common security vulnerabilities, attack techniques, and industry-standard mitigation strategies.

• Excellent problem-solving, analytical, and organizational skills.

• Strong verbal and written communication skills with the ability to influence remediation efforts across multiple teams.

• Lead cross-functional vulnerability remediation meetings with business stakeholders, application owners, infrastructure teams, and technical teams to communicate vulnerability risk, validate findings, define remediation strategies, establish ownership and timelines, resolve remediation blockers, and drive security findings through closure

Experience Preferred:

• Experience with cloud platforms such as AWS, Azure, or GCP.

• Familiarity with threat intelligence platforms and security operations workflows.

• Knowledge of scripting or automation technologies such as PowerShell, Python, Bash, or APIs.

• Experience with asset management and CMDB platforms.

• Understanding of security frameworks and standards such as NIST, CIS Controls, ISO 27001, or PCI-DSS.

• Industry certifications such as Security+, CySA+, GSEC, SSCP, CEH, or similar security certifications.

Licenses/Certification Required:

• Security Certification

Licenses/Certification Preferred:

• Cloud, Security+, Network +, Tenable.io VM or OT, Tanium Comply or Patch

Skills and Abilities:

• Wide knowledge of application and IT product diversity, interoperability, and extensive knowledge in IT security

• Ability to configure and conduct vulnerability scans using VM tools such as Tenable.io and Tanium

• Understanding of VM lifecycle within cloud environment for discovering, scanning, analyzing, and triage

• Ability to interpret threat and vulnerability data using Sysco’s vulnerability scanning tools

• Provide patching teams details needed for prioritized remediation leveraging Kenna

Physical Demands:

• Reasonable accommodations will be made to enable individuals with disabilities to perform the essential functions of this job.'

Work Environment:

• Hybrid Role-Based Houston

AFFIRMATIVE ACTION STATEMENT:

Applicants must be currently authorized to work in the United States. We are proud to be an Equal Opportunity and Affirmative Action employer, and consider qualified applicants without regard to race, color, creed, religion, ancestry, national origin, sex, sexual orientation, gender identity, age, disability, veteran status or any other protected factor under federal, state or local law. This opportunity is available through Sysco Corporation, its subsidiaries and affiliates.