Threat Exposure & Attack Surface Analyst (R-00191)

Job Responsibilities

• Analyze enterprise vulnerability data to identify the highest priority cyber exposures across the NIH environment.
• Maintain awareness of CISA Known Exploited Vulnerabilities (KEVs), emerging threats, and active adversary campaigns that may affect NIH systems.
• Correlate vulnerability findings with threat intelligence, exploit availability, attack techniques, and operational risk to improve remediation prioritization.
• Evaluate the enterprise attack surface, identify high value targets, and assess how changes in infrastructure, cloud services, identities, or external exposure influence organizational risk.
• Validate penetration testing findings and determine whether identified vulnerabilities create realistic attack paths or opportunities for privilege escalation and lateral movement.
• Assess compensating controls and remediation effectiveness to ensure corrective actions meaningfully reduce enterprise risk.
• Support vulnerability management teams by recommending remediation priorities based on exploitability, mission impact, and threat activity rather than vulnerability severity alone.
• Collaborate with incident responders, penetration testers, ISSOs, and security engineers to continuously refine enterprise risk prioritization.
• Develop technical analyses, exposure assessments, executive summaries, and operational reporting that clearly communicate enterprise cyber exposure to technical and executive audiences.
• Support RMF activities by providing technical justification for POA&M prioritization, risk acceptance decisions, and continuous monitoring efforts.
• Recommend improvements to attack surface management, threat-informed vulnerability prioritization, and enterprise exposure management processes.

Job Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Information Systems, or a related technical discipline.
• Three or more years of experience supporting vulnerability management, attack surface management, cyber threat intelligence, penetration testing, security operations, or enterprise risk analysis.
• Experience analyzing vulnerability data and translating technical findings into operational risk.
• Working knowledge of CVSS, Common Vulnerabilities and Exposures (CVEs), CISA Known Exploited Vulnerabilities (KEV), MITRE ATT&CK, and modern threat intelligence methodologies.
• Understanding of attack paths, identity based attacks, lateral movement, privilege escalation, and common adversary tactics, techniques, and procedures (TTPs).
• Familiarity with NIST RMF, FISMA, and Federal cybersecurity practices.
• Strong analytical, investigative, and technical writing skills.
Preferred Qualifications:
Experience supporting NIH, HHS, or other Federal civilian agencies.
Experience with Tenable, Qualys, Rapid7, Armis, CrowdStrike Exposure Management, Microsoft Defender, ServiceNow, or similar enterprise security platforms.
Experience supporting penetration testing activities and remediation validation.
Experience with external attack surface management (EASM), cyber asset attack surface management (CAASM), or exposure management platforms.
Familiarity with cloud security, Zero Trust, and enterprise architecture concepts.
Experience supporting continuous monitoring, RMF, and POA&M management.
Preferred Certifications:
One or more of the following is preferred:
• GIAC Certified Vulnerability Assessor (GCVA)
• GIAC Penetration Tester (GPEN)
• GIAC Defending Advanced Threats (GDAT)
• CompTIA CySA+
• Certified Ethical Hacker (CEH)
• Security+