This role pays less than
87%
of similar roles. Most pay
$162,655–$239,512
— the shaded band above.
At the midpoint, this role pays about
$143k
versus about
$201k
for comparable roles.
Based on 240 similar postings.
Employer
About CNA Financial
CNA Financial is a Chicago-based commercial property and casualty insurance company, offering business insurance and risk-management services to companies across the United States and internationally.
CNA Financial currently has
18 open roles
on FindRole.
Listed pay typically runs
$97,000–$189,000
across 15 roles with salary data.
The AI Attack Surface and Threat Exposure Management Consulting Director leads the strategy, adoption, and governance of automation, AI, and agentic AI across application security, vulnerability management, ethical hacking, and attack surface management programs. This role involves evaluating and deploying AI-centric solutions while establishing audit-defensible standards and secure development practices for tools involving prompts, workflows, and guardrails. The position focuses on identifying and remediating external attack surface risks through advanced automation and analytics to improve operational efficiency. Key technical competencies include a deep understanding of vulnerability management, cloud security, and threat management, alongside strong knowledge of GenAI, LLM, and agentic AI security concepts. Candidates must possess experience in software development or scripting to drive the use of AI for threat modeling, code review, penetration testing, and automated risk analysis across the enterprise.
Define and implement strategies for integrating automation, AI, and agentic AI into application security and vulnerability management programs.
Evaluate, deploy, and govern AI-centric solutions across ethical hacking and attack surface management domains.
Establish audit-defensible governance standards, playbooks, and processes for secure AI adoption and usage.
Develop secure AI development practices including guardrails, prompts, and workflows to ensure code adheres to security standards.
Identify and analyze external attack surface risks through the continuous improvement of automated tools and analytics.
Drive the use of AI to enhance threat modeling, code review, penetration testing, and vulnerability remediation.
Provide metrics, reporting, and expert guidance to senior leadership regarding risk management and regulatory alignment.
What we're looking for
Bachelor’s Degree required or equivalent work experience.
Master’s Degree in Computer Science or technical field (preferred).
Relevant certifications (preferred).
Minimum of ten years of information security or related work experience in fields such as application security, vulnerability management, ethical hacking, or security engineering.
In-depth understanding of Vulnerability Management, Application Security, Cloud Security, Ethical Hacking, Threat Management, and Security Remediation programs.
Strong working knowledge of AI/ML, GenAI, LLM, and agentic AI security concepts and common attack/defense techniques.
Demonstrated experience in software development, scripting, and developing or maturing service, tooling, and process automation.
Working knowledge of regulations such as SOX and privacy, along with internal controls as they apply to IT.
AI
Machine Learning
Generative AI
LLM
AWS
Google Cloud
DevSecOps
CI/CD
SDLC
NIST AI RMF
OWASP Top 10 for LLMs
MITRE ATLAS
Threat Modeling
Vulnerability Management
Threat Intelligence
AI
Large Language Models
MITRE ATT&CK
Cyber Kill Chain
Diamond Model
Python
PowerShell
C#
C++
Reverse-engineering
Anomaly Detection
Vulnerability Research
Network Protocols
Incident Response