Security Analyst, Attack Surface Management

Role overview

Responsibilities

• Triage and validate Bugcrowd submissions through reproduction, confirmation, deduplication, and severity assessment.
• Assess impact using exploitability, asset exposure, data sensitivity, authentication requirements, and existing controls.
• Track findings from red team engagements and adversary simulations through remediation, retesting, and closure.
• Evaluate compensating controls, document them, and set expiry conditions for exceptions.
• Write actionable remediation guidance for application and platform engineers.
• Escalate Critical findings to Incident Response with reproduction details and blast-radius assessments.
• Partner with application and product teams on remediation timelines and escalate delayed risk acceptance decisions.
• Monitor externally exposed assets and flag newly surfaced attack surface for assessment.
• Use Python for reproduction harnesses and finding automation.

Required qualifications