Exposure Management SME

About the Role

In this role, you will lead the development and operationalization of the organization's Continuous Threat Exposure Management (CTEM) and cloud exposure management capabilities.

You will help move vulnerability management beyond traditional severity-based approaches by introducing attack-path analysis, business-context prioritization, and measurable risk reduction practices. Your focus will be identifying the exposures that matter most, validating their real-world impact, and ensuring they are effectively remediated.

You will work closely with cloud security, engineering, governance, and platform teams to build a modern exposure management program across AWS and GCP environments.

Responsibilities

• Design and implement the CTEM and risk-based vulnerability management program, including recommending the framework it follows.
• Define the prioritization methodology that combines vulnerabilities, misconfigurations, identity exposures, and business context.
• Analyze cloud attack paths and chains to identify and validate the highest-risk exposure scenarios.
• Define remediation SLAs and separate workflows for backlog, new, and emergency findings, aligned with GRC exception and risk acceptance processes.
• Build executive reporting focused on risk reduction and exposure metrics.

Requirements

• 5+ years of experience in cloud security, vulnerability management, exposure management, or offensive security.
• Strong understanding of CTEM principles and risk-based security programs.
• Experience with CNAPP solutions (preferably Upwind or Wiz).
• Experience performing attack-path analysis and exposure validation.
• Strong knowledge of AWS and GCP security architecture.
• Understanding of IAM security, privilege escalation paths, and identity exposure risks.
• Experience building or operating vulnerability management programs.
• Experience collaborating with engineering and platform teams to drive remediation.
• Strong analytical and stakeholder communication skills.
• Very good English level (B2+-C1)
• Exposure management, attack surface management, or security operations experience would be a plus.
• Offensive security or penetration testing background would be nice to have
• Experience with cloud AI environments and AI infrastructure security is considered a plus
• Experience with security telemetry and detection engineering are nice to have
• One or more industry-recognized security certifications, such as AWS Certified Security – Specialty, Google Professional Cloud Security Engineer, CISSP, CCSK, CCSP, or equivalent are an advantage.
• Familiarity with MITRE ATT&CK and MITRE ATLAS considered as an advantage