Attack Surface Management Service Lead Consultant - Exposure Intelligence Team

Overview

Lead the founding Attack Surface Management (ASM) capability within Allstate's new Exposure Management function, acting as the subject-matter expert for the enterprise's internet-facing attack surface.

What you'll do

• Translate external attack surface findings into exposure intelligence and exploitability-based prioritization.
• Identify attack paths that start from internet-facing assets, such as exposed services, misconfigurations, expired or weak certificates, and exposed admin interfaces.
• Produce clear remediation guidance and partner with asset owners to validate closure.
• Own SME coverage for external attack surface discovery and monitoring using EASM and scanning platforms (e.g., Censys, Qualys).
• Establish asset governance practices, including attribution, ownership assignment, inventory reconciliation, and detection of shadow IT and orphaned assets.
• Extend visibility to third-party, subsidiary, and cloud-hosted footprints, and partner with Penetration Testing, Product Security, and Exposure Response to operationalize findings.

What you'll need

• 3+ years in attack surface management, vulnerability management, security operations, or exposure management.
• Strong understanding of internet-facing infrastructure, including DNS, IP space, certificates, cloud hosting, and common external misconfigurations.
• Ability to translate technical findings into business risk and practical remediation actions.

Nice to have

• Hands-on experience with Censys or comparable EASM platforms, and with Qualys or similar vulnerability scanning tools.
• Familiarity with asset inventory/CMDB processes, cloud provider connectors, and third-party risk practices.
• Ability to build a new capability from the ground up, including processes, metrics, and stakeholder buy-in, as the first person in the function.

Details

• Location: US, remote.
• Compensation: 100,000.00 - 170,500.00 annually, based on experience and qualifications.
• Candidates offered this position will be required to submit to a background investigation.
• Allstate generally does not sponsor individuals for employment-based visas for this position.