Threat Exposure Analyst (52)

Summary

Working remotely in a full-time capacity, the Threat Exposure & Attack Surface Analyst will identify, validate, and prioritize cybersecurity risks for the National Institutes of Health (NIH), focusing on vulnerability management, threat intelligence, and attack surface management.Key responsibilitiesAnalyze enterprise vulnerability data to identify the highest priority cyber exposures across the NIH environmentCorrelate vulnerability findings with threat intelligence and operational risk to improve remediation prioritizationDevelop technical analyses and operational reporting to communicate enterprise cyber exposure to technical and executive audiencesRequired qualificationsBachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related technical disciplineThree or more years of experience in vulnerability management, cyber threat intelligence, or enterprise risk analysisExperience analyzing vulnerability data and translating technical findings into operational riskWorking knowledge of CVSS, CVEs, CISA KEVs, and MITRE ATT&CKUnderstanding of attack paths, privilege escalation, and common adversary tactics

Job Description

Working remotely in a full-time capacity, the Threat Exposure & Attack Surface Analyst will identify, validate, and prioritize cybersecurity risks for the National Institutes of Health (NIH), focusing on vulnerability management, threat intelligence, and attack surface management.Key responsibilitiesAnalyze enterprise vulnerability data to identify the highest priority cyber exposures across the NIH environmentCorrelate vulnerability findings with threat intelligence and operational risk to improve remediation prioritizationDevelop technical analyses and operational reporting to communicate enterprise cyber exposure to technical and executive audiencesRequired qualificationsBachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related technical disciplineThree or more years of experience in vulnerability management, cyber threat intelligence, or enterprise risk analysisExperience analyzing vulnerability data and translating technical findings into operational riskWorking knowledge of CVSS, CVEs, CISA KEVs, and MITRE ATT&CKUnderstanding of attack paths, privilege escalation, and common adversary tactics