Sr. Consultant, Surface Area Management

The Senior Vulnerability Management Analyst safeguards the organizations digital assets by leading the identification assessment prioritization and remediation of cybersecurity vulnerabilities across the global enterprise. This role serves as a trusted advisor and technical leader driving enterprise vulnerability management strategy governance and continuous improvement initiatives. With minimal supervision the Senior Analyst partners with cybersecurity infrastructure cloud engineering risk and business leaders to reduce organizational exposure and improve cyber resilience.

-Leading enterprise-wide vulnerability management and exposure reduction programs.
-Performing advanced analysis of vulnerability data from tools such as Tenable Qualys Rapid7 Wiz and cloud-native security platforms.
-Establishing risk-based prioritization methodologies that incorporate threat intelligence exploit activity business criticality and compensating controls.
-Driving remediation accountability and governance across technology and business stakeholders.
-Developing executive-level reporting metrics and risk insights for leadership and governance forums.
-L-eading major vulnerability response efforts related to zero-day threats actively exploited vulnerabilities and high-profile CVEs.
-Identifying systemic vulnerability trends and recommending strategic improvements to reduce recurring risk.
-Partnering with Threat Intelligence Threat Hunting Red Team Incident Response and Security Architecture teams to validate and enrich findings.
-Leading continuous improvement efforts related to scanning coverage asset visibility attack surface management and remediation effectiveness.
-Designing and implementing dashboards automation and integrations to improve program efficiency and reporting.
-Consulting on security architecture cloud adoption and remediation strategies across on-premises and cloud environments.
-Mentoring junior analysts and providing technical leadership during complex investigations and remediation efforts.
-Staying current on threat actor behaviors emerging attack techniques exploit trends and industry best practices.
-Demonstrating deep expertise in CVSS EPSS MITRE ATT&CK threat modeling and cyber risk management frameworks.
-Providing strategic guidance for remediation across Windows Linux networking cloud platforms (AWS Azure GCP OCI) containers and modern enterprise technologies.

ESSENTIAL FUNCTIONS
-VULNERABILITY MANAGEMENT STRATEGY & GOVERNANCE: Leads the design implementation operation and continuous improvement of enterprise vulnerability management capabilities. Establishes standards governance processes performance metrics and risk management practices to reduce organizational exposure.
-EXTERNAL ATTACK SURFACE MANAGEMENT: Provides strategic oversight of the organizations external attack surface identifying emerging risks prioritizing remediation efforts and guiding improvements to overall exposure management practices.
-RISK-BASED PRIORITIZATION & REMEDIATION: Develops and maintains enterprise risk models for vulnerability prioritization ensuring remediation efforts focus on the most significant business and cybersecurity risks.
-THREAT-INFORMED VULNERABILITY MANAGEMENT :Integrates vulnerability management with threat intelligence threat hunting offensive security and incident response capabilities to improve detection prioritization and remediation outcomes.
-PROGRAM LEADERSHIP & CONTINUOUS IMPROVEMENT: Leads cross-functional initiatives that improve scanning coverage asset visibility remediation performance governance processes and overall program maturity.
-EXECUTIVE COMMUNICATION & STAKEHOLDER MANAGEMENT: Communicates complex technical risks to executive leadership and business stakeholders influencing strategic decisions and prioritization of remediation activities.

• Minimum requirement of 5 years of relevant cybersecurity vulnerability management attack surface management or exposure management experience.
• Typically reflects 7 years of relevant experience.
• Experience leading enterprise-scale vulnerability management exposure management or cyber risk reduction initiatives preferred.
• Demonstrated experience influencing senior leaders and driving cross-functional remediation efforts.
• Relevant industry certifications such as CISSP GSEC GIAC Security CySA AWS Security Azure Security Engineer or equivalent are preferred