Senior Information Security Analyst Attack Surface Management Lead

Site: Mass General Brigham Incorporated

Mass General Brigham relies on a wide range of professionals including doctors nurses business people tech experts researchers and systems analysts to advance our mission. As a not-for-profit we support patient care research teaching and community service striving to provide exceptional care. We believe that high-performing teams drive groundbreaking medical discoveries and invite all applicants to join us and experience what it means to be part of Mass General Brigham.

Job Summary

Position Summary
The Mass General Brigham Senior Information Security Analyst Attack Surface Management Function Lead will be responsible for advancing and coordinating the MGB Attack Surface Management capability across vulnerability discovery penetration testing attack surface analysis and attack simulation. This role will help lead the function into a risk-driven validation-focused capability that identifies meaningful exposure prioritizes remediation based on exploitability and business impact and connects findings to detection engineering threat hunting threat intelligence and broader Cyber Defense priorities.

The ideal candidate is a deeply technical security professional with experience in vulnerability management offensive security exposure analysis penetration testing or adversary simulation. They should be comfortable translating technical findings into actionable risk narratives guiding engineers through complex analysis and helping prioritize work based on business risk asset criticality threat relevance and exploitability.

Key Areas of Experience
Vulnerability discovery and vulnerability management
Attack surface analysis and exposure management
Penetration testing and exploit validation
Attack simulation adversary emulation or breach and attack simulation

Principal Duties and Responsibilities
Vulnerability Discovery: Support and mature processes to identify vulnerabilities across infrastructure applications cloud environments endpoints and externally exposed assets. Ensure findings are enriched with asset context ownership severity exploitability and business impact to support effective prioritization and remediation.
Attack Surface Analysis: Analyze exposed assets services technologies identities ownership gaps and environmental risk to identify meaningful exposure. Translate attack surface data into actionable recommendations for risk reduction.
Penetration Testing Coordination: Support penetration testing activities including scoping methodology technical validation reporting and remediation follow-up. Ensure findings are clearly documented risk-ranked and connected to broader Cyber Defense improvement opportunities.
Attack Simulation: Coordinate and support attack simulation and adversary emulation activities to validate security controls response processes and detection coverage. Map activity to MITRE ATT&CK where appropriate and recommend improvements to preventive detective and response capabilities.
Remediation Prioritization: Prioritize remediation activity based on exploitability asset criticality business context exposure and threat relevance. Partner with technology owners to communicate findings clearly and track remediation through appropriate workflows.
Detection and Threat Hunting Handoffs: Partner with Security Detections Threat Intelligence and Threat Hunting teams to ensure ASM findings inform detection engineering hunt development and intelligence-driven security priorities.
Program Maturity: Develop and maintain repeatable processes SOPs playbooks reporting standards and quality expectations for ASM workflows. Identify opportunities to improve consistency scalability and operational maturity across the function.
Incident Response Support: Support the incident response team by providing insight into potential attack paths exploitable vulnerabilities exposed assets and adversary techniques that may be relevant during a cyber incident.
Written Documentation: Create review and update documentation related to attack surface management processes findings reports remediation recommendations playbooks and security controls.
Communication: Provide clear and concise written and verbal communication including technical reporting long-form documentation stakeholder updates and executive presentations. Translate technical detail into language appropriate for the intended audience.
Industry Knowledge: Maintain awareness of emerging vulnerabilities attacker techniques offensive security methods exposure management practices and technologies that may impact MGBs security posture.
MGB Values: Use Mass General Brigham values to guide decisions actions and behaviors including Patients Affordability Accountability & Service Commitment Decisiveness Innovation & Thoughtful Risk Diversity & Inclusion Integrity & Respect Learning Continuous Improvement & Personal Growth and Teamwork & Collaboration.
Other duties as assigned.

• Associates degree in a related field of study required or bachelors degree in a related field of study required.
• Experience may be accepted in lieu of a degree.

• Relevant professional certifications preferred or required such as GCIH GPEN CISSP OSCP or similar credentials.

• 57 years of relevant experience required.

• Authority in cybersecurity concepts within the roles domain.
• Proficient understanding of cybersecurity concepts outside of a specific individual domain.
• Expertise with the tools and solutions supported by the team.
• Ability to apply original and innovative thinking to produce new ideas.
• Strong leadership communication and project management skills.
• Strong decision-making skills with the ability to weigh the relative costs and benefits of potential actions and identify the most appropriate path forward.

• MondayFriday Eastern business hours.
• Onsite presence required one day per week.
• Flexibility required for additional onsite days for meetings or business needs as planned and scheduled.
• Remote workdays require a stable secure quiet and compliant workstation using MGB-provided equipment.

Hybrid

399 Revolution Drive

40

Regular

Day (United States of America)

Pay Range

$93953.60 - $136739.20/Annual

Grade

7

At Mass General Brigham we believe in recognizing and rewarding the unique value each team member brings to our organization. Our approach to determining base pay is comprehensive and any offer extended will take into account your skills relevant experience if applicable education certifications and other essential factors. The base pay information provided offers an estimate based on the minimum job qualifications; however it does not encompass all elements contributing to your total compensation addition to competitive base pay we offer comprehensive benefits career advancement opportunities differentials premiums and bonuses as applicable and recognition programs designed to celebrate your contributions and support your professional growth. We invite you to apply and our Talent Acquisition team will provide an overview of your potential compensation and benefits package.

0100 Mass General Brigham Incorporated is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race color religious creed national origin sex age gender identity disability sexual orientation military service genetic information and/or other status protected under law. We will ensure that all individuals with a disability are provided a reasonable accommodation to participate in the job application or interview process to perform essential job functions and to receive other benefits and privileges of employment. To ensure reasonable accommodation for individuals protected by Section 503 of the Rehabilitation Act of 1973 the Vietnam Veterans Readjustment Act of 1974 and Title I of the Americans with Disabilities Act of 1990 applicants who require accommodation in the job application process may contact Human Resources at .