Vulnerability Assessment (VA) Team Lead (CBP)

Findings get prioritized by real exploitability and impact to this environment, not just a generic severity score.

You can tell the difference between a finding that is theoretical and one that is genuinely reachable, and you communicate that difference.

Assessment coverage reaches the systems that matter most, not just the ones that are easiest to scan.

Findings that get flagged as critical get fixed, and you can show the trend closing over time.

Engineering teams bring you into the fix, not just the finding, when the remediation is not obvious.

Recurring finding types get traced to a build standard or process gap and closed at the source.

What is reported as open, in progress, or accepted matches reality at any given time.

Accepted risk decisions are documented with a real justification, not left as findings that quietly stopped getting tracked.

Leadership gets an accurate picture of the environment's exposure, including what has not been assessed yet.

New systems and changes get assessed before they go live, not discovered later in a routine scan.

Assessment methodology improves based on what real findings turned out to matter, rather than staying static.

You can name where assessment coverage is thin and what it would take to close that gap.

You have led vulnerability assessment or penetration testing work that produced findings engineering teams actually acted on.

You have prioritized findings by real exploitability rather than by scanner severity score alone, and can describe how.

You have worked in a federal or highly regulated environment and know what that adds to remediation timelines and risk acceptance processes.

You have gotten a team to fix something that had not caused a visible problem yet, and can describe how you made the case.

You hold an active CBP BI, a fitness determination at another DHS component, or an active DoD clearance. Any of these shortens your start date.

Certifications such as OSCP, GPEN, or equivalent are useful, but they are not a substitute for having driven real remediation.