IT Cyber Specialist

 AFS IT is seeking an IT Cyber Specialist to track, review, and help remediate the vulnerabilities and misconfigurations that the Wiz for Gov Cloud Security Posture Management (CSPM) / CNAPP platform identifies across AFS's Azure, AWS, and GCP cloud environments. This role is the day-to-day owner of the cloud vulnerability lifecycle: from the first finding in Wiz for Gov through risk-based prioritization, ticketing, remediation follow-up, validation, and closure.
The IT Cyber Team's purpose is to protect the AFS brand. The team applies security strategies and safeguards against current and emerging threats using all available tools, including Wiz for Gov. The specialist works hand in hand with infrastructure, cloud, and application teams and with Information Security to ensure security compliance and risk-mitigation best practices are applied across the enterprise, while balancing usability and business operations.
This role will help establish and sustain the recurring processes, metrics, and ticket workflows that keep cloud findings visible, owned, and resolved within agreed timelines.

The Work

Vulnerability Tracking and Triage (30%)

• Monitor and review new and recurring findings in Wiz for Gov (vulnerabilities, misconfigurations, exposed resources, toxic combinations, and compliance issues) across all onboarded cloud accounts.
• Validate findings, remove noise, and prioritize by severity, exploitability, internet exposure, asset criticality, and business context to determine remediation priority.
• Open, assign, and track tickets for each actionable finding, ensuring a named system owner and target date for every item.
• Maintain an accurate vulnerability register and track findings through to verified closure, including risk acceptances and approved exceptions.

Remediation Support (30%)

• Work directly with system owners and infrastructure, cloud, and application teams to explain findings, recommend remediation actions, and assess feasibility and impact of proposed fixes.
• Follow up on open items, escalate overdue or blocked remediation, and help remove impediments.
• Drive server patch compliance through the Patch Management Incident Ticket process (monthly and application-specific).
• Drive the removal of end-of-life software in server and endpoint environments.
• Re-scan and validate in Wiz for Gov that remediation is effective before closing items.

Critical Vulnerability and Incident Response (15%)

• Respond to critical and high-severity findings, including P1 incident creation and escalation between the IT Cyber team and infrastructure teams, and coordinate resolution according to established processes.
• Serve as a technical escalation point for day-to-day IT Cyber team activities involving cloud vulnerabilities.Reporting, Compliance, and Governance (10%)
• Produce recurring metrics and dashboards (open findings by severity, aging, SLA compliance, remediation trends, and top risk owners) for IT Cyber leadership and stakeholders.
• Support evaluation of the security posture against cybersecurity frameworks and requirements (CMMC, NIST SP 800-171, CIS) and support audit and compliance evidence requests.

Wiz for Gov Operations and Continuous Improvement (10%)

• Support day-to-day Wiz for Gov operations, including user access and roles, saved views and reports, and notification and ticketing integrations, in coordination with the cloud engineering team.
• Recommend tuning of policies, ignore rules, and workflows to reduce false positives and improve remediation speed; identify opportunities to automate repetitive tracking and reporting tasks.
• Document procedures, runbooks, and lessons learned to support operations and maintenance handoff.

Agile Team Participation (5%)

• Participate as a DevOps/Agile team member: communicate progress, escalate impediments, align with teammates on dependencies, and decompose stories into tasks with effort estimates.
• Support the Product Owner in refining backlog items (acceptance criteria, descriptions, test scenarios, estimates) and gather stakeholder feedback during the sprint.
• Deliver fully tested, documented work products that meet the Definition of Done.

What you need

•  U.S. Citizen located on U.S. soil (mandatory)
• Vulnerability management and remediation tracking (Intermediate)
• Cyber security fundamentals, including risk-based prioritization (CVSS, exploitability, asset criticality) (Intermediate)
• Cloud security concepts across Azure, AWS, and/or GCP (Intermediate)
• Cybersecurity frameworks: CMMC, NIST SP 800-171, CIS (Basic to Intermediate
•  Incident and ticket management, including escalation workflows (Intermediate)
• Agile methodology (Basic to Intermediate)
• Written and verbal communication; ability to work independently on moderately complex tasks and collaborate effectively with technical and non-technical stakeholders

Bonus if you have   

• Cloud Security Posture Management (CSPM/CNAPP) experience in Azure, AWS, and/or GCP
• Experience with Wiz or the Wiz for Gov platform
• Patch management and end-of-life software remediation experience
• Scripting or automation for reporting and ticketing workflows (e.g., Python, PowerShell, APIs)
• Security certification such as Security+, CySA+, CISSP, or a cloud security certification