Attack Surface Management Service Lead Consultant - Exposure Intelligence Team

Allstate • McCullom Lake, IL

5d • $100,000 - $170,500

About The Position

The Lead Consultant – Attack Surface Management is the subject matter expert responsible for discovering, monitoring, and governing Allstate’s internet-facing attack surface, including unknown and unmanaged assets, external exposures, and third-party and subsidiary footprints. As the founding member of this capability within the Exposure Management function, the consultant establishes attack surface management practices and applies Continuous Threat Exposure Management (CTEM) principles to connect external findings to real attack paths. The role partners with asset owners to drive remediation that measurably reduces exploitable exposure.

The team is focused on modernizing enterprise vulnerability identification, prioritization, and mitigation by shifting from traditional patch approaches to a strategic focus on business risk and exploitability. The position translates security insights into practical remediation strategies and exposure intelligence, identifying attack paths originating from internet-facing assets and providing clear remediation guidance. Success includes broader, validated external attack-surface coverage, fewer unknown or unowned assets, faster assignment and mitigation of newly discovered exposures, and higher-quality findings with fewer false positives.

Requirements

• At least 3 years of experience in attack surface management, vulnerability management, security operations, or exposure management.
• Strong understanding of internet-facing infrastructure, including DNS, IP space, certificates, cloud hosting, and common external misconfigurations.
• Ability to translate technical findings into business risk and practical remediation actions.

Nice To Haves

• Hands-on experience with Censys or comparable EASM platforms and Qualys or similar vulnerability scanning tools.
• Familiarity with asset inventory/CMDB processes, cloud provider connectors, and third-party risk practices.
• Ability to build a new capability from the ground up, including processes, metrics, and stakeholder buy-in, as the first person in the function.

Responsibilities

• Translate external attack-surface findings into exposure intelligence and exploitability-based prioritization.
• Identify attack paths that start from internet-facing assets, including exposed services, misconfigurations, expired or weak certificates, and exposed admin interfaces.
• Produce clear remediation guidance and partner with asset owners to validate closure.
• Own subject-matter-expert coverage for external attack-surface discovery and monitoring using EASM and scanning platforms such as Censys and Qualys.
• Establish asset governance practices, including attribution, ownership assignment, inventory reconciliation, and detection of shadow IT and orphaned assets.
• Extend visibility to third-party, subsidiary, and cloud-hosted footprints.
• Partner with Penetration Testing, Product Security, and Exposure Response to operationalize findings.
• Establish attack surface management practices and apply CTEM principles to connect external findings to real attack paths.
• Drive remediation with asset owners to measurably reduce exploitable exposure.

Benefits

• Comprehensive technology setup, including a laptop, monitors, headset, keyboard, and mouse.
• Monthly connectivity reimbursement for employees eligible to work from home.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed