Security Manager, Attack Surface Management (Hybrid - Seattle)

Location: Hybrid in Seattle, Washington; must work at the hirify.global corporate headquarters at least 4 days per week.

Salary: $166,000–$258,000 annual.

Company

hirify.global is a retail company operating enterprise technology and cybersecurity environments.

What you will do

• Lead, coach, and develop attack surface analysts through prioritization, mentorship, training, certification support, and career development.
• Grow the enterprise attack surface management program, define its roadmap, and implement capabilities across cloud, on-premises, and third-party environments.
• Own attack surface mapping, reconnaissance, dark web monitoring, risk-based vulnerability triage, expedited remediation, and remediation timelines.
• Drive enterprise initiatives, architectural improvements, process automation, and security tool enhancement to reduce vulnerabilities and exposures.
• Partner with threat intelligence, offensive security, AppSec, DevOps, and cloud platform teams to prioritize exposures and implement secure-by-design practices.
• Present executive metrics, maintain standards and runbooks, lead compliance activities, and manage tool evaluations, vendors, budgets, and project timelines.

Requirements

• 6+ years in security operations, vulnerability management, offensive security, or attack surface management, including 2+ years leading a team or working in a senior or lead capacity.
• Enterprise experience building, running, or growing an attack surface or exposure management program, including mentoring analysts and developing technical career paths.
• Deep knowledge of MITRE ATT&CK, threat actor TTPs, common attack vectors, offensive security methodologies, external reconnaissance, and ethical hacking.
• Experience implementing cloud security controls in multi-cloud environments using AWS, Azure, and GCP, including exposure of S3 buckets and Azure Blob storage.
• Working knowledge of vulnerability identification, CSPM, attack surface and exposure management platforms, and network security tools.
• Proficiency in scripting languages such as Python or PowerShell for process automation and working knowledge of emerging AI technologies in attack surface management.
• Advanced knowledge of networking, system administration, cloud services, asset management, and enterprise IT architecture.
• Understanding of regulatory and compliance controls for vulnerability and attack surface management, including PCI.
• Strong leadership and communication skills, including translating technical exposure data for business audiences, presenting to senior leadership, and influencing technical and business teams.
• Bachelor’s or Master’s degree in Information Technology, Computer Science, Cybersecurity, or a related field; equivalent experience may substitute for a degree.

Nice to have

• Experience managing budgets, vendor relationships, and security tool evaluations.
• Experience with CVSS, risk prioritization frameworks, and threat intelligence platforms.
• Awareness of patch management, hardening, secure configuration management, lifecycle management, and other cyber hygiene practices.
• Thought leadership applying emerging AI technologies in cybersecurity.
• Advanced certifications such as OSCE, GREM, CISSP, or CISM.

Culture & Benefits

• Hybrid work requires at least 4 days per week in the Seattle corporate headquarters.
• Medical/vision, dental, retirement, paid time away, life insurance, and disability benefits are available.
• Benefits also include merchandise discounts, EAP resources, PTO accruals, holidays, and potential performance-based incentives or bonuses.
• Benefits eligibility may depend on location, job level, classification, and length of employment.