Security Analyst Consultant - Attack Surface Management

ABOUT KALLES GROUP:Everyone deserves to be secure. Our mission at Kalles Group is to help secure the future for companies of all shapes and sizes.While our expertise spans multiple disciplines, our method remains consistent: building trust and relationship with people -- whether you are a client, a consultant, or--in this case--a candidate.No matter what role you come from--whether you're an executive or just starting your career-you can expect our highest level of attention and respect. We want to find the right fit for each role, but we also want you to find the right fit for your career.We believe the best way to show you what our team is like is to treat you like you're already a part of it. We hope you'll consider joining our team of experienced professionals who are building their careers at Kalles Group—and having fun while doing it.WHAT YOU WILL DO: As a Senior Security Analyst Consultant – Attack Surface Management, you will lead and evolve our client’s enterprise Attack Surface Management (ASM) program, helping reduce cyber risk through proactive discovery, analysis, automation, and collaboration. This is a highly visible role that combines strategic leadership with hands-on technical execution, requiring expertise across vulnerability management, cloud security, threat intelligence, and offensive security disciplines.You will be responsible for developing a comprehensive view of the organization's attack surface, identifying opportunities to reduce exposure, and driving remediation efforts in partnership with engineering, cloud, DevOps, and security teams. Leveraging data, automation, and threat intelligence, you will help prioritize risk reduction initiatives while influencing architectural decisions that strengthen the organization’s security posture. This role is ideal for someone who enjoys building programs, solving complex security challenges, and partnering across the enterprise to create meaningful security outcomes.KEY RESPONSIBILITIES: Lead and mature the organization's Attack Surface Management (ASM) program, identifying opportunities to expand capabilities and improve visibilityDevelop and maintain a comprehensive understanding of the enterprise attack surface across cloud, network, and application environmentsContinuously identify, assess, and prioritize vulnerabilities and exposures based on business and security riskPartner with security, engineering, infrastructure, and cloud teams to drive remediation efforts and reduce riskLeverage metrics and analytics to measure program effectiveness and inform risk-based decision makingConduct external reconnaissance activities, OSINT research, and threat intelligence analysis to identify potential exposure pointsMonitor emerging threats, attacker techniques, and industry trends to proactively strengthen defensive capabilitiesCollaborate with Application Security, DevOps, and Cloud Engineering teams to promote secure-by-design practicesContribute to incident response investigations and post-incident analysis as neededDesign and implement automation solutions that improve visibility, efficiency, and risk management workflowsDevelop and maintain operational standards, procedures, documentation, and runbooksMentor team members and share expertise across security domainsSupport compliance initiatives including PCI DSS, SOC 2, and related regulatory requirementsValidate security controls and identify opportunities for continuous improvementABOUT YOU:Your values:Integrity: You believe in doing the right thing, even when it's uncomfortable, seemingly inefficient, or costly.Purposefulness: You have a desire to serve others with your skillset and an openness to continuous learning and growth.Ownership: You stick to your commitments, follow up with action, and seek clarity in communication & expectations.YOUR EXPERIENCE:Required Qualifications6+ years of experience in cybersecurity, including security operations, threat hunting, offensive security, red teaming, or related disciplinesExperience building, scaling, or leading Attack Surface Management (ASM) capabilities and programsStrong understanding of vulnerability management methodologies and risk prioritization frameworksExperience working within multi-cloud environments, including AWS, Azure, and GCPDeep knowledge of attacker tactics, techniques, and procedures (TTPs) and frameworks such as MITRE ATT&CKExpertise in network security, cloud security, attack path analysis, and external attack surface discoveryExperience conducting OSINT, reconnaissance, and threat intelligence activitiesProficiency with scripting and automation technologies such as Python and PowerShellStrong understanding of enterprise infrastructure, application architectures, and data flowsAbility to evaluate and influence architectural decisions that reduce organizational riskExperience leading cross-functional security initiatives and driving collaboration across multiple teamsExcellent written and verbal communication skills with the ability to communicate effectively with both technical and non-technical stakeholdersStrong analytical and problem-solving skills with a data-driven approach to risk managementPreferred QualificationsIndustry certifications such as CISSP, OSCE, GREM, or similar cybersecurity credentialsExperience applying AI and automation technologies to security operations or attack surface management programsExperience with cloud-native security platforms and exposure management toolingFamiliarity with threat modeling, purple teaming, or advanced adversary simulation exercisesExperience working in large-scale enterprise environments with complex security requirementsWHAT WE OFFER:The annual salary range for this role is $110,000-$140,000. We offer Medical, Dental, Vision plans, 401K with matching, and PTO for salaried employees.Work/life balance – we know there’s more to life than work! We encourage our team to pursue other passions, get outside, and spend time with family. We work with clients and consultants to set expectations for a manageable workload.LOCATION:This role is on-site at our client location in Seattle, WA. At this time, we are only considering candidates who currently live in Seattle, WA. HOW TO APPLY: Please fill out the form below (including uploading your most recent resume) and we'll be in touch! We know imposter syndrome can be a barrier to many great applicants. We hope you'll still consider applying. That's why we've made the application process as short and simple as possible.Even if you're not a fit for the role, you can expect to hear back from us! We want you to have the best experience as a candidate, so please feel free to share feedback at any stage of the process to View email address on click.appcast.io Group is an equal-opportunity employer and does not discriminate on the basis of creed, nationality, race, ethnicity, disability, gender, or other protected class.