Senior Security Engineer Attack Surface Platforms (Remote)

First American•California Home - G4, CA

23h•$112,400 - $149,800•Remote

About The Position

The Senior Security Engineer – Attack Surface Platforms serves as the subject matter expert for the organization’s external attack surface management (EASM) capability. The role leads platform operations, asset discovery coverage, exposure analysis, and remediation workflows for internet-facing assets. The engineer works across security and technology teams to validate findings, direct risk reduction, improve platform quality, and develop repeatable processes and targeted enhancements. The position partners with Security Operations, Cloud Engineering, Network Engineering, Infrastructure, application teams, IT asset owners, Security Architecture, and business stakeholders. It also works with the EASM vendor and internal platform teams to resolve issues, assess product capabilities, and plan changes that improve external visibility and remediation outcomes. The role generally requires a bachelor’s degree in Computer Science, Information Technology, Engineering, or a related field, or equivalent practical experience. Typically, candidates have 4–6 years of relevant technical experience. Hands-on EASM platform experience is required, Cortex Xpanse experience is strongly preferred, and candidates must hold at least one foundational cloud or cloud security certification at the time of selection.

Requirements

Hands-on experience operating an external attack surface management or attack surface management platform (EASM or CTEM).
Strong understanding of internet-facing assets, common network services and protocols, DNS, web infrastructure, cloud-hosted resources, and the security risks of external exposure.
Experience validating vulnerability, exposure, and misconfiguration findings and prioritizing remediation using technical evidence and business context.
Working knowledge of at least one major cloud platform, including its core services and terminology.
Experience integrating security platforms with asset inventory, ticketing, cloud security, or security operations systems and troubleshooting data quality or workflow issues.
Ability to use APIs or basic scripting in a language such as Python, PowerShell, or Bash to investigate findings, validate data, and support platform enhancements.
Ability to establish clear ownership and remediation paths for findings and communicate risk and recommended actions to technical and nontechnical stakeholders.
Strong analytical, written, and verbal communication skills; ability to manage work independently, guide cross-functional remediation, and provide technical direction to peers.
Bachelor’s degree in Computer Science, Information Technology, Engineering, or a related field, or equivalent practical experience.
Typically 4–6 years of experience in information security, external attack surface management, vulnerability management, cloud security, security operations, or a related technical role.
At least one foundational cloud or cloud security certification at the time of selection, demonstrating familiarity with cloud concepts and core services and terminology of at least one major cloud provider, or broadly applicable knowledge across security domains.

Nice To Haves

Experience across multiple cloud platforms.
Cortex Xpanse experience.
Additional certifications or formal credentials in application security, secure software development, vulnerability management, or cloud security.

Responsibilities

Serve as the technical subject matter expert for the EASM platform and administer its configuration, access, integrations, workflows, reporting, and operational health.
Maintain reliable discovery and inventory of internet-facing domains, IP addresses, hosts, and services; review coverage, data quality, changes, and newly observed assets for potential gaps or unmanaged exposure.
Validate asset attribution and ownership by correlating findings with business, cloud, network, DNS, and inventory context; identify unknown or potentially unauthorized assets and route them for investigation.
Analyze external exposures, including vulnerable technologies, misconfigurations, exposed services, and assets that do not meet security standards; prioritize response using exposure context, exploitability, business importance, and available threat information.
Lead remediation coordination with cloud, network, infrastructure, application, and business teams; clarify risks and recommended actions, track progress, verify closure, and escalate urgent or overdue exposures through established processes.
Tune platform policies, risk settings, alerting, and exception workflows to improve signal quality and reduce duplicate or non-actionable findings; document material changes and validate their results.
Build and maintain integrations between the EASM platform and asset inventory, ticketing, cloud security, or security operations systems; troubleshoot data flow, mapping, ownership, and workflow issues with platform administrators and vendors.
Develop targeted automation and platform enhancements using APIs, scripts, dashboards, and workflow features to improve asset review, triage, reporting, and remediation tracking.
Produce operational and management reporting on asset coverage, newly discovered assets, exposure trends, remediation status, recurring issues, and platform health; explain data limitations and highlight items requiring action.
Lead EASM onboarding and change reviews for new domains, business units, cloud environments, brands, and acquisitions; ensure discovery and ownership processes are updated as the organization changes.
Support security investigations and incident response when an externally exposed asset or service may contribute to risk; preserve relevant platform evidence and coordinate follow-up with response teams.
Develop runbooks and standards for EASM operations and guide platform users and partner teams on finding validation, ownership, prioritization, and effective remediation.