The position is described below. If you want to apply, click the Apply Now button at the top or bottom of this page. After you click Apply Now and complete your application, you'll be invited to create a profile, which will let you see your application status and any communications. If you already have a profile with us, you can log in to check status.

Need Help?

If you have a disability and need assistance with the application, you can request a reasonable accommodation. Send an email to Accessibility (accommodation requests only; other inquiries won't receive a response).

Regular or Temporary:

Regular

Language Fluency:  English (Required)

Work Shift:

1st shift (United States of America)

Please review the following job description:

The Cybersecurity Engineer (Attack Surface Management) is responsible for designing, implementing, and maturing advanced security validation capabilities to safeguard enterprise systems and applications. This role focuses on continuous security validation through External Attack Surface Management (EASM) tools, integration with existing security infrastructure, and providing actionable insights to strengthen the firm’s cyber resilience. The engineer partners with cross-functional teams to simulate real-world adversarial tactics, techniques, and procedures (TTPs), evaluate control effectiveness, and recommend enhancements that align with enterprise risk management and regulatory standards.

Essential Duties and Responsibilities

Following is a summary of the essential functions for this job.  Other duties may be performed, both major and minor, which are not mentioned below.  Specific activities may change from time to time. 

• ​​​EASM Validation and Engineering: Investigate and reproduce findings from EASM platforms (e.g., exposed services, misconfigurations, weak crypto, DNS issues, leaked assets) 

• ​Perform Active/Passive Reconnaissance: Familiarity with open-source techniques and tools for profiling attack surface 

• ​Advance EASM Capabilities: Develop tuning logic for discovery seeds and asset correlation. Continuously improve signal fidelity and automate common validation tasks 

• ​Execute BAS Scenarios: Plan and conduct realistic cyberattack simulations that mirror real-world threat actor TTPs across enterprise environments. 

• ​Analyze Simulation Results: Assess BAS outcomes to identify security control gaps, vulnerabilities, and opportunities for improved detection and response. 

• ​Provide Actionable Recommendations: Develop and communicate prioritized recommendations to strengthen security policies, procedures, and technical controls. 

• ​Collaborate Across Teams: Work with red, blue, and purple teams, as well as incident response and threat intelligence groups, to adjust alerts, rules, and detection logic. 

• ​Threat Hunting and Intelligence: Leverage threat intelligence to inform EASM scenarios and proactively address emerging threats. 

• ​Vulnerability Management Support: Contribute to the identification, prioritization, and remediation of vulnerabilities based on simulation and testing results. 

• <