Key Responsibilities

Attack Surface Management

• Own and continuously evolve the enterprise external attack surface inventory — internet-facing assets, domains, IP ranges, cloud services, third-party integrations, and shadow IT

• Proactively discover unauthorized, unmanaged, or impersonation-related assets and investigate exposed services, SSL/TLS and DNS misconfigurations, open ports, cloud storage exposure, and leaked credentials surfaced through EASM tooling

• Track assets across the full discovery-to-remediation lifecycle and maintain authoritative records in the CAASM platform

Attack Path Analysis & Threat Exposure Modeling

• Model attack paths across hybrid on-premises, cloud, and identity infrastructure (Active Directory, Entra ID, cloud IAM) using graph-based tooling to expose lateral movement and privilege escalation opportunities

• Prioritize remediation by attack path criticality, asset business value, and exploitability — beyond CVSS — and identify choke points whose remediation eliminates the greatest number of paths

• Partner with red team, purple team, and breach-and-attack simulation engagements to validate models, mapping findings to MITRE ATT&CK and CTEM program metrics

Asset Intelligence & CAASM

• Build and maintain a unified, authoritative asset view by integrating telemetry across endpoints, cloud APIs, network scanners, CMDBs, and identity directories, enriched with criticality ratings and business ownership

• Drive asset criticality modeling and support EPM governance so the Vulnerability & Exposure Management team can prioritize remediation by business impact, not volume

Automation, Analytics & Reporting

• Build dashboards for attack surface posture, attack path risk, remediation velocity, and security KPIs for operational and executive audiences

• Develop scripting and automation (Python, REST APIs) and apply AI-assisted analytics to improve data collection, enrichment, risk correlation, and predictive risk signals

• Produce posture reports and executive summaries, and manage cybersecurity exceptions, risk acceptances, and governance documentation per policy

Cross-Functional Partnership

• Serve as the subject-matter expert on attack surface and attack path topics during architecture reviews, onboarding, and risk assessments, partnering with Vulnerability & Exposure Management, Cloud Security, Network, SOC, Application Security, and Governance teams to drive end-to-end risk reduction

• Communicate technical risk findings and remediation recommendations clearly to both technical teams and non-technical business stakeholders

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Engineering, or a related field

• 5+ years of progressive experience in Cybersecurity, Security Operations, Vulnerability/Exposure Management, or Attack Surface Management

• Hands-on experience across EASM(asset discovery and exposure analysis), CAASM(asset data integration and unified inventory), attack path / attack graph modelingacross hybrid environments, and exposure-based prioritizationthat goes beyond basic CVSS

• Working knowledge of MITRE ATT&CK adversary techniques (initial access, lateral movement, privilege escalation, persistence)

• Hands-on experience with cloud environments (AWS, Azure, or GCP) and cloud-specific exposure risks (storage misconfigurations, IAM over-privilege, exposed APIs)

• Proficiency in scripting for automation and data analysis (Python preferred) and integrating security tools via APIs to build dashboards and workflows

• Strong written and verbal communication; able to translate technical risk into clear business language for senior stakeholders

Certifications (Preferred)

• CISSP, CISM, or CISA

• Offensive/exposure-focused: CEH, OSCP, or GIAC (GPEN, GWAPT, GCIH)

• Cloud security: AWS Security Specialty, Microsoft AZ-500, or (ISC)² CCSP