Vulnerability Analyst
Posted 22 Jul 2026
Advertised as “Senior Vulnerability Analyst (US)”
BranchFactor Summary
The original posting with the fluff stripped out
- Expected experience
- 2+ yrs
- Management level
- Individual contributor
- Employment
- Remote
- Contract
- Full-time
No salary listed for this role.
Senior Vulnerability Analyst
Location: MA / Austin TX / MD
Team: Research
Employment Type: Full-Time, Remote
About VulnCheck
Exploitation prevention is only as strong as the intelligence driving those efforts, and most of the industry is still running on intelligence that lacks exploit context. VulnCheck, The Exploit Intelligence Company, delivers structured exploit intelligence on what is actively weaponized in the wild, purpose-built for the data lakes, ETL pipelines, automation, and AI and LLM workflows your infrastructure already runs on, raising the capability of everything it powers.
About the Role
The VulnCheck CNA (CVE Numbering Authority) processes thousands of vulnerability reports and issues thousands of CVEs a year, collaborating with community researchers, open-source projects, commercial software suppliers, the CVE community, and global security organizations to get vulnerabilities fixed and properly disclosed.
We’re looking for a Senior Vulnerability Analyst with hands-on experience conducting coordinated vulnerability disclosure (CVD) and publishing CVEs to join VulnCheck’s CNA team. In this role, you’ll triage and validate vulnerability reports submitted to VulnCheck’s Report a Vulnerability service, coordinate disclosures across suppliers and researchers, and populate high-quality CVE and advisory data for global consumption. This is an opportunity to be part of a fast-growing CNA with a community-driven mission to get vulns fixed and make better vulnerability data accessible to everyone.
This is a 100% remote role with preference for candidates located in Massachusetts, Maryland, OR Greater Austin TX.
What You’ll Do
- Assess vulnerability reports submitted through VulnCheck’s Report a Vulnerability service for overall validity and CVE eligibility
- Conduct vulnerability disclosure conversations with software suppliers, security researchers (vulnerability reporters), and standards communities, guiding all parties toward mutually beneficial outcomes
- Where needed, follow CNA Operational Rules for submitting disputes or conducting escalations to get CVE records assigned and published appropriately (e.g., by following formal dispute processes)
- Populate CVE metadata accurately, including calculating correct CVSS scores, assigning CWEs, and mapping discovered vulnerabilities to MITRE ATT&CK techniques and CAPEC attack patterns