Cybersecurity Analyst, External Attack Surface Management (EASM)
Key Responsibilities
1. Detection Evaluation and Technical Validation
· Triage EASM platform findings for validity, real-world severity, and exploitability
· Verify exposures non-destructively using DNS and WHOIS enumeration, TLS certificate inspection, HTTP header analysis, service fingerprinting, and passive reconnaissance
· Document evidence sufficient to justify escalation or dismissal: request and response captures, scan output, DNS and certificate records
· Research referenced CVEs to confirm the vulnerable version or configuration is actually present and reachable
2. Asset Ownership Identification and Attribution
· Attribute flagged assets (domains, IP ranges, certificates, cloud services, SaaS instances) to the responsible engineering team, or to the owning business unit or subsidiary where the team cannot be determined
· Investigate undocumented assets using WHOIS, DNS, cloud resource tagging, CMDB, and certificate metadata
· Maintain asset-to-owner mapping documentation as attribution gaps are closed
· Escalate unattributable assets through the appropriate governance channel
3. Real-World Risk Assessment
· Assess findings from an attacker's perspective (reachability, authentication context, data sensitivity, business impact) to confirm or correct vendor-assigned severity
· Separate theoretical risk from exploitable risk so respondent teams stay focused on genuine exposure
· Document compensating controls (WAF, authentication gates, network segmentation, geo-restriction) that materially change effective severity
· Produce a severity rationale defensible to both the owning team and security leadership
4. VIT Creation and Remediation Tracking
· Create Vulnerability and Issue Tickets (VIT) in ServiceNow with technical evidence, business context, and specific remediation steps
· Route tickets to the correct owning team with appropriate priority and SLA
· Track tickets through closure, re-validating that the exposure is actually resolved rather than only claimed resolved
· Pursue stalled, disputed, or misrouted tickets and escalate when SLAs are at risk
5. Respondent Team Support and Remediation Guidance
· Serve as technical point of contact for asset-owning teams working an EASM-sourced VIT
· Provide remediation guidance tailored to the owning team's platform and operational constraints
· Run or coordinate re-scans once remediation is claimed complete
· Explain why a finding matters, not only what to fix, to build durable ownership in engineering teams
6. Platform Tuning and Operational Automation
· Tune Ionix discovery seeds, scan scope, and suppression rules to reduce false positives and improve signal quality
· Script against the Ionix API to automate enrichment, deduplication, attribution lookups, and recurring reporting
· Support integration of EASM output into ServiceNow and security operations telemetry pipelines
· Maintain triage, escalation, and disposition SOPs so the workflow stays repeatable and auditable
7. Program Operations and Reporting
· Maintain accurate finding status and remediation SLA performance
· Surface recurring patterns, such as systemic misconfigurations or repeat-offending platforms, for process or policy improvement
· Report on attack surface posture, remediation velocity, and coverage
· Keep finding dispositions documented and audit-ready
8. Coordination and Program Expansion
· Work directly with business unit and subsidiary Information Security Officers and Segment Architecture contacts
· Partner with cloud and platform engineering on remediation and preventive configuration
· Coordinate with SOC, Threat and Vulnerability Management, and Offensive Security on escalations and overlapping findings
· Onboard additional business units, subsidiaries, and acquired environments as scope expands
Technical Skills Required
Each of the following is applied daily and will be probed directly in interview. The bar is working fluency, not familiarity.
· DNS: Trace a name to its terminal resource across CNAME and delegation chains, and recognize when it resolves to infrastructure Humana no longer controls (dangling records, stale delegation, takeover-eligible targets)
· TLS and certificates: Read a certificate to establish what it actually covers and who issued it; use SAN entries and certificate transparency logs to discover hosts absent from inventory; separate simple expiration from misissuance
· Web and network exposure: Judge from HTTP responses, headers, and service banners what an endpoint is, whether it is authenticated, and whether reaching it is real exposure, rather than reporting an open port on its own
· Cloud exposure: Explain how an AWS, Azure, or Google Cloud Platform resource became publicly reachable (storage ACLs, security group and network rules, unauthenticated endpoints), and use resource tags and naming conventions to attribute it to an owner
· Vulnerability analysis: Confirm whether a reported CVE applies to the deployed version and configuration, and defend a severity that departs from the CVSS base score when reachability or compensating controls justify it
· Scripting: Query a REST API, parse JSON and CSV, and reconcile two asset lists without doing it by hand. Python preferred. The bar is automating repetitive work, not software engineering
Required Qualifications
· Bachelor's degree in Computer Science, Cybersecurity, or a related field, or equivalent hands-on cybersecurity experience
· 2 to 4 years of experience in vulnerability management, attack surface management, security operations, or a comparable technical security analyst role
· Working knowledge of internet-facing asset types (DNS, certificates, cloud-hosted services, SaaS) and the specific ways they become exposed or misconfigured
· Demonstrated ability to independently investigate and validate a security finding to technical conclusion without close supervision. This role expects exceptional execution at a mid-level experience band
· Experience with vulnerability or ticketing systems (ServiceNow or equivalent) for issue tracking and SLA management
· Strong written communication skills, specifically the ability to translate a technical finding into remediation guidance that a non-specialist asset owner can act on
· Comfort working directly with asset-owning engineering teams to drive remediation, including following up on stalled or disputed tickets
· Ability to ramp quickly within an established enterprise process rather than requiring a greenfield program to be built
Preferred Qualifications
· Prior hands-on experience with an EASM or attack surface management platform (Ionix, Censys, Microsoft Defender External Attack Surface Management, or similar)
· Familiarity with IT asset inventory and cloud tagging practices (AWS, Azure, Google Cloud Platform) in support of ownership attribution
· Experience in a large, multi-subsidiary or acquisition-driven enterprise environment where asset ownership is frequently unclear or contested
· Working knowledge of MITRE ATT&CK and common web and network exploitation techniques
· Experience integrating security tooling output into enterprise systems via API, including ServiceNow or a SIEM platform
· Relevant certifications such as Security+, GWAPT, GCIH, OSCP, or equivalent demonstrated practical skill
