Must Haves: Vulnerability management experience, performing NIST based risk and maturity assessments, incident response planning, and delivering security awareness training.