> Markdown version of [/jobs/ext/3789360-attack-surface-management-lead-consultant](https://www.wearedevelopers.com/jobs/ext/3789360-attack-surface-management-lead-consultant). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Attack Surface Management Lead Consultant

- **Company:** Allstate Corporation
- **Location:** Springfield, IL, United States
- **Experience:** Expert
- **Salary:** $105,000.0 - $155,000.0
- **Contract:** Permanent contract
- **Skills:** Cloud Computing Security, Network Security, Vulnerability Analysis
- **Published:** October 16, 2026
- **Apply:** https://find.jobs/jobs-near-me/apply/ats-redirect/?id=3023584702-2

## About the Role

* Attack Surface Management
 * External Attack Surface Management (EASM)
 * Asset Discovery
 * Asset Inventory Management
 * Cloud Security
 * Network Security
 * DNSIP Space Management
 * Certificate Security
 * Vulnerability Scanning

## Description

Lead the development of Allstate's attack surface management capability by discovering and monitoring internet-facing assets, identifying exploitable exposures and attack paths, and prioritizing remediation based on business risk. Establish asset governance and collaborate with asset owners and security teams to validate and resolve findings across enterprise, cloud, third-party and subsidiary environments., * Discover and monitor internet-facing assets, including unknown, unmanaged and orphaned assets.

 * Translate external attack surface findings into exploitability-based exposure intelligence and business risk priorities.
 * Identify attack paths involving exposed services, misconfigurations, weak or expired certificates, and exposed administrative interfaces.
 * Establish asset governance practices for attribution, ownership assignment and inventory reconciliation.
 * Provide practical remediation guidance and partner with asset owners to verify closure.
 * Extend visibility to third-party, subsidiary and cloud-hosted environments and operationalize findings with security teams.