Note: The job is a remote job and is open to candidates in USA. SailPoint is seeking a highly technical and forward-thinking Senior Attack Surface Management Analyst to support its global attack surface management program. The role focuses on continuously discovering and attributing digital assets, analyzing security exposures, prioritizing remediation, orchestrating security validation exercises, automating workflows, and mentoring junior analysts.
Responsibilities
- Execute and scale continuous discovery processes to map and maintain a real-time, comprehensive inventory of all external-facing and internal digital assets, including domains, IPs, APIs, complex cloud resources (AWS, Azure, GCP), SaaS applications, and Shadow IT
- Develop and implement robust asset attribution models, writing scripts to query asset databases and integrate disparate inventories (CMDB, cloud accounts) into a unified, reliable "single source of truth"
- Proactively identify security exposures like misconfigured cloud storage, exposed administrative portals, outdated systems, and vulnerabilities (including emerging zero-days) across our entire attack surface
- Contribute to intelligence-led prioritization efforts by combining vulnerability severity (beyond CVSS), real-world exploit availability (drawing from CISA KEV and other threat intel sources), business criticality, data sensitivity, mapped attack paths, and active threat intelligence to determine "what matters most" and "what to fix first" while uncovering root causes
- Orchestrate Breach and Attack Simulation (BAS) and Autonomous Pentesting exercises, safely simulating real-world attacks (mapped to MITRE ATT&CK) to validate the efficacy of existing security controls (SIEM, EDR, Firewalls) and prove vulnerability exploitability
- Collaborate with Engineering, DevOps, and IT teams to define remediation SLAs, build automated ticketing workflows, and verify fixes through continuous monitoring and programmatic re-scanning
- Support continuous Purple Teaming initiatives, partnering closely with offensive (Red Team) and defensive (SOC/Blue Team) functions to translate attack surface findings into resilient detection rules
- Build and maintain automation scripts and API integrations to streamline asset enrichment, automated scanning, threat intelligence correlation, and ticketing system updates
- Evaluate, recommend, and implement cutting-edge ASM and Attack Path mapping platforms to continuously optimize our technical capability stack
- Provide technical leadership and mentorship to junior analysts, fostering deep technical skill development and elevating the team’s overall capabilities
- Become fully comfortable with core processes and tools (e.g., Vulnerability scanning and BAS tooling), including analysis, ticketing, and internal workflows
- Solidify relationships with key partners across the Enterprise and within Cyber teams
- Contribute to asset and domain baselining analysis by auditing public-facing inventory, subdomains, certificates, and IP ranges
- Assist with establishing alert routing from ASM tooling
- Perform comprehensive exposure analysis across ASM datasets to publish a risk-prioritized remediation roadmap targeting high-severity public risks
- Confidently engage with teams to work through remediation problems and ensure operational flow
- Design baseline ASM metrics to be delivered to security leadership
- Collaborate with Risk & Governance to formalize ASM SLAs, discovery cadences, and remediation mandates into corporate security policies
- Optimize tool configuration of ASM tools to reduce scanner noise and false positives
- Become a strong, effective contributor who actively identifies and suggests areas for process improvement
- Take the lead on an internal team project, such as establishing runbooks for the ASM team, risk reduction campaign, or lead implementation of a recommended security hardening measure
- Operationalize risk-based prioritization correlating findings that impact the company at the vulnerability, configuration, assets exposure, and vendor level
- Establish continuous bi-directional validation by integrating ASM intelligence into BAS tooling and Red Team adversary emulation workflows
- Partner with Infrastructure and Cloud teams to enforce standard golden images, Infrastructure-as-Code (IaC) security guardrails, and automated stale-asset decommission routines
- Collaborate with Risk & Governance team to incorporate ASM controls into existing policies
- Scale team capabilities by mentoring junior analysts, defining future ASM technology roadmaps, and authoring program maturity benchmarks
Skills
- • 5+ years of progressive, hands-on experience in Attack Surface Management, Vulnerability Management, Penetration Testing, Threat Intelligence, or Security Operations—with at least 1-2 years in a senior or lead capacity
- • Advanced Cloud Infrastructure Knowledge: Deep, practical experience securing and querying complex multi-cloud environments (AWS, Azure, or GCP), with a strong grasp of cloud security postures, IAM policies, and cloud-native APIs
- • Strong Automation & API Scripting Skills: Proven capability to write clean, maintainable scripts (Python, Go, or PowerShell) and utilize REST APIs to automate workflows, parse large JSON datasets, and stitch security tools together
- • Familiarity with Modern Enterprise Tech Stacks: Microservices, Kubernetes/containers, APIs, and modern CI/CD deployment pipelines
- • Direct Experience with ASM & Discovery Tooling: Solid proficiency with leading external attack surface management (EASM) and discovery platforms
- • Vulnerability & Workflow Tooling: Expertise using vulnerability management suites (e.g., Qualys, CrowdStrike Falcon Spotlight) and translating their outputs into automated remediation workflows
- • Attacker Mindset & Frameworks: Deep familiarity with the MITRE ATT&CK framework, active threat intelligence (e.g., Recorded Future), and attack path analysis tools
- • Outstanding Technical Communication: Track record of distilling highly complex technical exploits, cloud misconfigurations, and systemic risks into clear, actionable executive summaries and stakeholder remediation guides
- • Breach & Attack Simulation (BAS): Hands-on experience operating BAS or autonomous pentesting platforms
- • Cybersecurity AI Application: Familiarity with leveraging AI/ML technologies to enhance asset discovery, automate risk categorization, or defend against AI-driven adversarial attacks
- •Note: Candidates are required to obtain the AWS Certified Cloud Practitioner or AWS Certified Security - Specialty certification within the first year of employment if they do not already possess it.•
- • Industry Certifications: Advanced certs such as CISSP, OSCP, GPEN, GCIH, or CCSK are highly valued
Benefits
- This role is fully remote.
- This role may be eligible for the SailPoint Corporate Bonus Plan or a role-specific commission.
- Potential eligibility for equity participation.
- Medical, dental, and vision insurance.
- Short-term and long-term disability coverage.
- Life insurance and Accidental Death & Dismemberment (AD&D).
- Supplemental life insurance for employees, spouses, and children.
- Flexible spending accounts for health care and dependent care; limited purpose flexible spending account.
- 401(k) Savings and Investment Plan with company matching.
- Flexible vacation policy.
- 8 paid holidays annually.
- Sick leave.
- Paid parental leave.
- Employee Assistance Program (EAP) and Care Counselors.
- Voluntary benefits including Legal Assistance, Critical Illness, Accident, Hospital Indemnity and Pet Insurance options.
- Health Savings Account (HSA) with employer contribution.
Company Overview
Company H1B Sponsorship