Lead Consultant – Attack Surface Management, Exposure Intelligence

This is a fully remote position, open to applicants in United States.

📋 Description

• Identify, monitor, and manage Allstate’s internet-facing attack surface, encompassing unknown and unmanaged assets, external vulnerabilities, and the digital footprints of third parties and subsidiaries.

• Implement attack surface management practices and utilize CTEM principles to link external findings with actual attack pathways.

• Collaborate with asset owners to drive remediation efforts that effectively reduce exploitable risks.

• Convert external attack surface insights into exposure intelligence and prioritize based on exploitability.

• Detect attack pathways stemming from internet-facing assets, which include exposed services, misconfigurations, outdated or weak certificates, and unprotected administrative interfaces.

• Develop remediation recommendations and work alongside asset owners to ensure closure validation.

• Serve as the subject matter expert for external attack surface discovery and monitoring utilizing EASM and scanning tools such as Censys and Qualys.

• Establish governance practices for assets, including attribution, ownership assignments, inventory reconciliation, and the identification of shadow IT and orphaned assets.

• Broaden visibility to include third-party, subsidiary, and cloud-hosted footprints.

• Collaborate with Penetration Testing, Product Security, and Exposure Response teams to operationalize findings.

⛳️ Requirements

• Minimum of 3 years of experience in attack surface management, vulnerability management, security operations, or exposure management.

• In-depth understanding of internet-facing infrastructure, including DNS, IP address ranges, certificates, cloud hosting, and common external misconfigurations.

• Capability to interpret technical findings in terms of business risk and actionable remediation steps.

• Practical experience with Censys or similar EASM platforms, as well as Qualys or equivalent vulnerability scanning tools.

• Knowledge of asset inventory/CMDB processes, cloud provider integrations, and third-party risk management practices.

• Proven ability to develop a new capability from inception, including process creation, metric development, and securing stakeholder support.

• Background investigation is required.

• Allstate typically does not sponsor individuals for employment-based visas for this role.

• A dedicated, distraction-free workspace is essential when working remotely.

• A reliable internet connection with a minimum of 50 MB download speed and 5 MB upload speed is required.

🏝️ Benefits

• A thorough technology setup, which includes a laptop, monitors, headset, keyboard, and mouse.

• Monthly reimbursement for connectivity to help cover internet expenses.