- Assume end-to-end ownership of the existing Blue Team Exposure Management program and expand asset coverage, assessment frequency, and remediation speed.
- Maintain continuous visibility into the attack surface across endpoints, cloud, identities, APIs, and internet-exposed assets using CrowdStrike Falcon as the primary telemetry and posture source.
- Prioritize exposures by business risk, considering exploitability, exposure, business criticality, and signals such as CVSS, EPSS, and CISA KEV.
- Design and operate automations and AI agents to reduce manual work in triage, enrichment, correlation, and remediation ticket creation.
- Assess and monitor access and network posture in the SASE architecture, including ZTNA, SWG, and CASB, and identify overly permissive policies and exposure paths.
- Drive remediation with engineering and infrastructure squads, negotiate priorities, track SLAs, and formalize exceptions and risk acceptances.
- Validate exploitability by supporting penetration tests, bug bounty, or attack simulations, and follow through to remediation.
- Define and report program metrics, including exposure trends, MTTR, and SLA compliance, and produce evidence for audits and regulatory requirements.
AWSPythonGCP+1 more