After this lesson, you will be able to: Map the skills from this sub-track to real job titles, build a portfolio that gets interviews, and rehearse the questions hiring managers actually ask.
Vulnerability Management is one of the most reliable on-ramps into security because every regulated industry needs it. This lesson translates what you just learned into resume bullets, interview answers, and a portfolio plan.
Vulnerability Management Analyst, runs the scanners, triages findings, drives remediation. $65-$110k entry. Security Analyst (Tier 1 SOC), responds to scan and EDR alerts, escalates incidents. $55-$95k entry. Application Security Engineer (junior), SAST/DAST tool ownership, dev-security liaison. $90-$140k. Threat & Vulnerability Engineer, designs the VM program at scale; senior role. $130-$200k. GRC Analyst (overlap), uses VM data for audit and compliance reporting. $70-$120k. Search 'vulnerability management analyst', 'Tenable', 'Qualys', 'CVE triage' on LinkedIn.
Skills: OpenVAS, Nessus (Essentials), Nmap, CVE / CVSS / EPSS, CISA KEV, Splunk basics, patch management concepts, Windows + Linux fundamentals, Python (for automation). Projects: 'Ran OpenVAS in Docker against Metasploitable 2; triaged 80 findings into a 1-page remediation report.' 'Wrote 10 published CVE analyses (GitHub repo) covering 2025 critical bugs.' 'Built a patch policy for a fictional 500-person company including rings, tiers, ownership, and metrics.' Certs: Security+ in progress or held; CySA+ is the natural step up.
'Walk me through how you'd triage a scan with 1,500 findings.' (CISA KEV → CVSS → asset criticality.) 'What's the difference between CVE, CWE, and CVSS?' (Identifier vs weakness class vs severity score.) 'A developer pushes back on a patch saying it might break production. What do you do?' (Tests stakeholder management and prioritization.) 'Explain what CISA KEV is and why it matters more than CVSS for prioritisation.' (Tests practical knowledge.) 'How would you build a vulnerability management program from scratch?' (Senior question; cover scan cadence, asset inventory, ownership, metrics, exception process.)
Ship two of these inside 30 days. Each becomes a talking point in interviews.
Run OpenVAS against Metasploitable 2 OR DVWA in Docker. Triage to 1-page report. Publish on GitHub.
Write up 5-10 recent CVEs from CISA KEV using the cs-vuln-cve template. Publish to a blog or GitHub.
Draft a complete patch policy for a fictional 500-person company. Include rings, tiers, ownership, and three metrics.
Automate one scan workflow with Python (e.g., parse OpenVAS XML, filter CVSS >= 9, post to a Slack channel). Code on GitHub.
Claiming Nessus or Qualys experience without ever opening the tool. Recruiters and hiring panels ask follow-ups; bluffing fails. No public artefacts. Saying 'I did a project' is half the value; the other half is a link the interviewer can open. Treating patching as 'IT's problem'. Owning the cross-team workflow is what distinguishes a security mind from a tool operator. Skipping the metrics. Hiring managers ask 'how do you measure success'; have an answer (MTTP, % patched on time, # CISA KEV open).
Sign in and purchase access to unlock this lesson.