Threat Exposure Management Analyst

What you'll do

• Analyze how individual exposures chain into viable attack paths toward critical assets.
• Build and operate threat-informed prioritization models using exploit data and active campaign indicators.
• Map exposures to crown-jewel assets to ensure remediation priorities reflect business impact.
• Validate the exploitability of prioritized risks using breach-and-attack simulation and penetration testing findings.
• Assess whether existing compensating controls effectively reduce risk before mandating remediation.
• Maintain visibility across external, cloud, SaaS, and identity attack surfaces.
• Drive remediation actions across infrastructure and security teams by establishing ownership and SLAs.
• Produce technical and executive reports that translate exposure trends into business-risk terms.

What we're looking for

• You must possess valid and unrestricted U.S. work authorization.
• At least 8 years of experience in vulnerability management, attack surface management, exposure management, or offensive security is required.
• Experience leading security programs with a focus on governance, metrics, and cross-functional stakeholder engagement is required.
• Ability to assess attack paths, exploitability, and business impact beyond standard CVSS scoring is required.
• Practical experience incorporating threat intelligence and exploit data like EPSS and CISA KEV into prioritization is required.
• Proficiency in identifying vulnerabilities across operating systems, networks, cloud environments, identity platforms, and applications is required.
• Ability to influence cross-functional teams and translate technical exposure into business risk for executive audiences is required.
• Familiarity with the Gartner CTEM model, MITRE ATT&CK, and various vulnerability scoring standards is required.