Attack Surface Management Lead

Job Description:

Attack Surface Management Lead

Collaborate with Innovative 3Mers Around the World

Choosing where to start and grow your career has a major impact on your professional and personal life, so it’s equally important you know that the company that you choose to work at, and its leaders, will support and guide you. With a wide variety of people, global locations, technologies and products, 3M is a place where you can collaborate with other curious, creative 3Mers.

This position provides an opportunity to transition from other private, public, government or military experience to a 3M career.

The Impact You Will Make in this Role:

The Attack Surface Management (ASM) Lead will drive the identification, analysis, and reduction of the organization's digital and physical exposure across cloud, on-prem, OT, and third-party environments. This role will lead the enterprise-wide ASM strategy, combining external threat visibility with internal exposure reduction, and will oversee related functions such as vulnerability management, asset discovery, and exposure monitoring. ​

Key Responsibilities:

Management ​

• Define and execute the enterprise Attack Surface Management strategy across cloud, on-premises, and external environments. ​

• Lead and mentor a cross-functional ASM team, including direct oversight of the Vulnerability Management (VM) and Threat Intel & Testing Manager

• Establish clear goals, success metrics, and maturity roadmaps for ASM including VM and Threat Intel & Testing functions. ​

• Collaborate with IT, cloud, OT, and third-party risk teams to align ASM initiatives with organizational risk priorities. ​

• Manage vendor relationships and toolsets supporting ASM, external scanning, and attack surface discovery platforms.​

Technical​

• Lead efforts to map, monitor, and validate known and unknown assets, services, and digital exposures. ​

• Implement continuous discovery and monitoring of exposed assets and services, including shadow IT, abandoned infrastructure, expired domains, and misconfigured cloud resources. ​

• Develop and maintain asset classification and tagging strategies to support risk-based prioritization and contextual analysis. ​

• Correlate ASM findings with threat intelligence feeds and vulnerability data to identify high-risk exposures and inform remediation efforts. ​

• Define and implement processes for validation, triage, and escalation of ASM findings in coordination with vulnerability management and SOC teams. ​

• Oversee integration of ASM platforms with SIEM/SOAR solutions (e.g., Sentinel, Splunk, ServiceNow) to automate alerting, ticketing, and response workflows. ​

• Collaborate with security engineering and architecture teams to implement preventive controls, such as automated remediation, segmentation, or blocking of exposed services. ​

• Analyze trends and patterns in exposure data to identify systemic issues, control gaps, and architectural weaknesses.​

Organizational​

• Translate ASM insights into business risk terms and influence remediation priorities with stakeholders. ​

• Report attack surface trends, exposure metrics, and risk posture to senior leadership and governance forums. ​

• Collaborate with Security Architecture and GRC to integrate ASM outputs into risk registers and architectural reviews. ​

• Ensure ASM-related processes and reporting support regulatory, compliance, and audit requirements.

Your Skills and Expertise:

To set you up for success in this role from day one, 3M requires (at a minimum) the following qualifications:

• Bachelor's degree in cybersecurity or computer science (completed and verified prior to start) from an accredited university.

• Seven (7) years of experience in cybersecurity, with at least 2 years focused on ASM, external threat management, or exposure reduction in a private, public, government or military environment ​

Additional qualifications that could help you succeed even further in this role include:

• Relevant certifications (e.g., CISSP, OSCP, GIAC, CRTO) preferred.​

• Proven leadership experience managing security functions and personnel, ideally including vulnerability management. ​

• Strong understanding of enterprise architectures, networking, cloud environments (Azure, AWS, GCP), and OT/IoT systems. ​

• Experience with ASM tools (e.g., Randori, Censys, Shodan, Pa