Associate Vulnerability Assessments &… at Boeing · USA -…

Summary: The Boeing Company is currently seeking an Associate Vulnerability Assessments & Infrastructure Specialist to join the team in Kent, WA. This hands-on role supports vulnerability management across the Boeing estate and subsidiaries, providing vulnerability risk analysis, application security support, and remediation orchestration for both infrastructure and applications. Responsibilities: - Operate and optimize enterprise vulnerability assessment platforms and AppSec integrations to identify, validate, and prioritize security findings across infrastructure and applications - Perform technical exploitability analysis and business-impact assessments - Translate findings into prioritized, operationally feasible remediation actions for engineering, Information Technology (IT), and operations teams - Contribute to development and operationalization of assessment playbooks, scanning standards, AppSec scanning pipelines Static Application Security Testing/Software Composition Analysis/Dynamic Application Security Testing (SAST/SCA/DAST), reporting, and automation to improve detection fidelity and remediation velocity - Execute enterprise processes for scheduled and emergent vulnerability assessments, including infrastructure and application discovery, authenticated scanning, and targeted assessments - Configure, tune, and maintain vulnerability scanning platforms and AppSec integrations (e.g., Rapid7, Tenable, Qualys, Snyk, Veracode), manage credentials, scopes, schedules, and scan policies - Investigate findings to distinguish true positives from false positives and to identify environmental/configuration constraints, including container, cloud, and legacy systems - Correlate vulnerability scanner output with threat intelligence, application findings (SAST/DAST/SCA), and asset criticality to produce contextualized risk ratings and remediation priorities - Assess exploitability, potential for lateral movement, and operational impact for infrastructure, middleware, and application vulnerabilities - Create remediation plans and work with system owners, application teams, and subsidiary stakeholders to coordinate fixes, compensating controls, and risk-accepted outcomes - Track remediation burndown, Service Level Agreements (SLAs), and closure - Escalate high-risk items and produce executive and technical reports tailored to stakeholder audiences - Collaborate with VASM, AppSec, DevSecOps, engineering, and IT teams to operationalize new scanning capabilities, integrate AppSec pipelines, and reduce noise through tuning and automation - Contribute to continuous improvement: drive automation of ingestion/correlation pipelines, standardize playbooks and runbooks, and deliver training to remediation owners and subsidiary teams Required Qualifications: - 1+ years of experience with vulnerability scanning concepts and best practices, and operating enterprise vulnerability assessment platforms such as Rapid7, Tenable, or Qualys - 1+ years of experience with Linux and/or Windows Security - 1+ years of experience troubleshooting foundational networking issues (TCP/IP, DNS, routing, firewalls) and performing network scanning and assessments Preferred Qualifications: - Active Security+, Certified Information Systems Security Professional (CISSP), Certified in Risk and Information Systems Control (CRISC), or vendor/tool-specific certifications - 3+ years of experience analyzing vulnerability findings, triage true vs false positives, and identify environmental limitations or compensating controls - 3+ years of experience managing scan configurations, credentials, schedules, and assessment scope within large or distributed environments - Experience with application security (SAST/DAST/SCA) and ability to ingest or correlate AppSec findings with infrastructure vulnerabilities - Experience integrating vulnerability management with AppSec pipelines and DevSecOps toolchains (Continuous Integration/Continuous Deployment (CI/CD) integration, SCA, container scanning) - Experience with Boeing subsidiaries, mission domains, and supply chain considerations (e.g., Boeing Commercial Airplanes, Boeing Defense & Space, Boeing Global Services, and common subsidiary/supplier systems) - Experience with vulnerability risk rating methodologies (Common Vulnerability Scoring System (CVSS), Cybersecurity and Infrastructure Security Agency Stakeholder-Specific Vulnerability Categorization (CISA SSVC), or organization-specific risk models) and threat intelligence correlation - Experience with cloud environments and cloud-native scanning challenges (Amazon Web Services (AWS)/Azure/Google Cloud Platform (GCP)) and containerized workloads - Experience with regulated or compliance-driven environments and supporting audit or risk frameworks (e.g., National Institute of Standard Technology (NIST), International Organization for Standardization (ISO)) Required Skills: Vulnerability assessment platforms, Application security (SAST/DAST/SCA), Linux, Windows Security Important Skills: Networking troubleshooting, Cloud environments, Security certifications Nice-to-Have Skills: Collaboration, Communication, Problem-solving Benefits: Health insurance, Flexible spending accounts, Health savings accounts, Retirement savings plans, Life and disability insurance programs, Programs that provide for both paid and unpaid time away from work