> Markdown version of [/jobs/ext/2015843-mass-general-brigham-senior-information-security-analyst-attack-surface-management-function-lead](https://www.wearedevelopers.com/jobs/ext/2015843-mass-general-brigham-senior-information-security-analyst-attack-surface-management-function-lead). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Mass General Brigham Senior Information Security Analyst - Attack Surface Management Function Lead - **Company:** 0100 Mass General Brigham Incorporated - **Location:** United States (Remote available) - **Experience:** Expert - **Salary:** $93,954.0 - $136,739.0 - **Contract:** Permanent contract - **Skills:** Software System Penetration Testing, Cyber Security, Intrusion Detection and Prevention, Software Vulnerability Management, Cloud Platform System, Mitre Att&ck, Cyber Threat Analysis, Cybercrime, Form Processing, Cyber Warfare - **Published:** August 10, 2026 - **Apply:** https://www.dice.com/job-detail/4a7dcdce-1f6d-45f4-bebe-93023d144941 ## About the Role * Associate's degree in a related field of study required, or bachelor's degree in a related field of study required. * Experience may be accepted in lieu of a degree. Licenses and Credentials * Relevant professional certifications preferred or required, such as GCIH, GPEN, CISSP, OSCP, or similar credentials. Experience * 5-7 years of relevant experience required. Knowledge, Skills, and Abilities * Authority in cybersecurity concepts within the role's domain. * Proficient understanding of cybersecurity concepts outside of a specific individual domain. * Expertise with the tools and solutions supported by the team. * Ability to apply original and innovative thinking to produce new ideas. * Strong leadership, communication, and project management skills. * Strong decision-making skills, with the ability to weigh the relative costs and benefits of potential actions and identify the most appropriate path forward. ## Description The Mass General Brigham Senior Information Security Analyst - Attack Surface Management Function Lead will be responsible for advancing and coordinating the MGB Attack Surface Management capability across vulnerability discovery, penetration testing, attack surface analysis, and attack simulation. This role will help lead the function into a risk-driven, validation-focused capability that identifies meaningful exposure, prioritizes remediation based on exploitability and business impact, and connects findings to detection engineering, threat hunting, threat intelligence, and broader Cyber Defense priorities. The ideal candidate is a deeply technical security professional with experience in vulnerability management, offensive security, exposure analysis, penetration testing, or adversary simulation. They should be comfortable translating technical findings into actionable risk narratives, guiding engineers through complex analysis, and helping prioritize work based on business risk, asset criticality, threat relevance, and exploitability. Key Areas of Experience Vulnerability discovery and vulnerability management Attack surface analysis and exposure management Penetration testing and exploit validation Attack simulation, adversary emulation, or breach and attack simulation Principal Duties and Responsibilities Vulnerability Discovery: Support and mature processes to identify vulnerabilities across infrastructure, applications, cloud environments, endpoints, and externally exposed assets. Ensure findings are enriched with asset context, ownership, severity, exploitability, and business impact to support effective prioritization and remediation. Attack Surface Analysis: Analyze exposed assets, services, technologies, identities, ownership gaps, and environmental risk to identify meaningful exposure. Translate attack surface data into actionable recommendations for risk reduction. Penetration Testing Coordination: Support penetration testing activities, including scoping, methodology, technical validation, reporting, and remediation follow-up. Ensure findings are clearly documented, risk-ranked, and connected to broader Cyber Defense improvement opportunities. Attack Simulation: Coordinate and support attack simulation and adversary emulation activities to validate security controls, response processes, and detection coverage. Map activity to MITRE ATT&CK where appropriate and recommend improvements to preventive, detective, and response capabilities. Remediation Prioritization: Prioritize remediation activity based on exploitability, asset criticality, business context, exposure, and threat relevance. Partner with technology owners to communicate findings clearly and track remediation through appropriate workflows. Detection and Threat Hunting Handoffs: Partner with Security Detections, Threat Intelligence, and Threat Hunting teams to ensure ASM findings inform detection engineering, hunt development, and intelligence-driven security priorities. Program Maturity: Develop and maintain repeatable processes, SOPs, playbooks, reporting standards, and quality expectations for ASM workflows. Identify opportunities to improve consistency, scalability, and operational maturity across the function. Incident Response Support: Support the incident response team by providing insight into potential attack paths, exploitable vulnerabilities, exposed assets, and adversary techniques that may be relevant during a cyber incident. Written Documentation: Create, review, and update documentation related to attack surface management processes, findings, reports, remediation recommendations, playbooks, and security controls. Communication: Provide clear and concise written and verbal communication, including technical reporting, long-form documentation, stakeholder updates, and executive presentations. Translate technical detail into language appropriate for the intended audience. Industry Knowledge: Maintain awareness of emerging vulnerabilities, attacker techniques, offensive security methods, exposure management practices, and technologies that may impact MGB's security posture. MGB Values: Use Mass General Brigham values to guide decisions, actions, and behaviors, including Patients, Affordability, Accountability & Service Commitment, Decisiveness, Innovation & Thoughtful Risk, Diversity & Inclusion, Integrity & Respect, Learning, Continuous Improvement & Personal Growth, and Teamwork & Collaboration. Other duties as assigned. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime) - [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see) - [Getting under the skin: The Social Engineering techniques](https://www.wearedevelopers.com/videos/38-getting-under-the-skin-the-social-engineering-techniques) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)