{"id":175741,"url":"https://alion.io/job/massgeneralbrigham-senior-information-security-analyst-attack-surface-management-lead","title":"Senior Information Security Analyst - Attack Surface Management Lead","company":{"id":5797,"name":"Mass General Brigham","domain":"massgeneralbrigham.org","url":"https://alion.io/company/massgeneralbrigham","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":82,"open_postings":77,"ghost_share":0,"stale_share":0.688,"repost_share":0.026,"time_to_fill_p50_days":23,"computed_at":"2026-10-22T06:10:10Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Somerville, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":93953,"max":136739,"currency":"USD","period":"year","gross":null,"usd_annual":136739},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"MITRE ATT&CK","optional":false}],"status":"live","first_seen_at":"2026-08-06T00:00:00Z","employer_posted_date":"2026-08-06","last_verified_at":"2026-10-22T11:29:32Z","board_verified":true,"closed_at":null,"days_open":77,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":77},"description":"Site: Mass General Brigham IncorporatedMass General Brigham relies on a wide range of professionals, including doctors, nurses, business people, tech experts, researchers, and systems analysts to advance our mission. As a not-for-profit, we support patient care, research, teaching, and community service, striving to provide exceptional care. We believe that high-performing teams drive groundbreaking medical discoveries and invite all applicants to join us and experience what it means to be part of Mass General Brigham.\nJob Summary\nPosition SummaryThe Mass General Brigham Senior Information Security Analyst - Attack Surface Management Function Lead will be responsible for advancing and coordinating the MGB Attack Surface Management capability across vulnerability discovery, penetration testing, attack surface analysis, and attack simulation. This role will help lead the function into a risk-driven, validation-focused capability that identifies meaningful exposure, prioritizes remediation based on exploitability and business impact, and connects findings to detection engineering, threat hunting, threat intelligence, and broader Cyber Defense priorities.\nThe ideal candidate is a deeply technical security professional with experience in vulnerability management, offensive security, exposure analysis, penetration testing, or adversary simulation. They should be comfortable translating technical findings into actionable risk narratives, guiding engineers through complex analysis, and helping prioritize work based on business risk, asset criticality, threat relevance, and exploitability.\nKey Areas of Experience\nVulnerability discovery and vulnerability management\nAttack surface analysis and exposure management\nPenetration testing and exploit validation\nAttack simulation, adversary emulation, or breach and attack simulation\nPrincipal Duties and Responsibilities\nVulnerability Discovery: Support and mature processes to identify vulnerabilities across infrastructure, applications, cloud environments, endpoints, and externally exposed assets. Ensure findings are enriched with asset context, ownership, severity, exploitability, and business impact to support effective prioritization and remediation.\nAttack Surface Analysis: Analyze exposed assets, services, technologies, identities, ownership gaps, and environmental risk to identify meaningful exposure. Translate attack surface data into actionable recommendations for risk reduction.\nPenetration Testing Coordination: Support penetration testing activities, including scoping, methodology, technical validation, reporting, and remediation follow-up. Ensure findings are clearly documented, risk-ranked, and connected to broader Cyber Defense improvement opportunities.\nAttack Simulation: Coordinate and support attack simulation and adversary emulation activities to validate security controls, response processes, and detection coverage. Map activity to MITRE ATT&CK where appropriate and recommend improvements to preventive, detective, and response capabilities.\nRemediation Prioritization: Prioritize remediation activity based on exploitability, asset criticality, business context, exposure, and threat relevance. Partner with technology owners to communicate findings clearly and track remediation through appropriate workflows.\nDetection and Threat Hunting Handoffs: Partner with Security Detections, Threat Intelligence, and Threat Hunting teams to ensure ASM findings inform detection engineering, hunt development, and intelligence-driven security priorities.\nProgram Maturity: Develop and maintain repeatable processes, SOPs, playbooks, reporting standards, and quality expectations for ASM workflows. Identify opportunities to improve consistency, scalability, and operational maturity across the function.\nIncident Response Support: Support the incident response team by providing insight into potential attack paths, exploitable vulnerabilities, exposed assets, and adversary techniques that may be relevant during a cyber incident.\nWritten Documentation: Create, review, and update documentation related to attack surface management processes, findings, reports, remediation recommendations, playbooks, and security controls.\nCommunication: Provide clear and concise written and verbal communication, including technical reporting, long-form documentation, stakeholder updates, and executive presentations. Translate technical detail into language appropriate for the intended audience.\nIndustry Knowledge: Maintain awareness of emerging vulnerabilities, attacker techniques, offensive security methods, exposure management practices, and technologies that may impact MGB’s security posture.\nMGB Values: Use Mass General Brigham values to guide decisions, actions, and behaviors, including Patients, Affordability, Accountability & Service Commitment, Decisiveness, Innovation & Thoughtful Risk, Diversity & Inclusion, Integrity & Respect, Learning, Continuous Improvement & Personal Growth, and Teamwork & Collaboration.\n• Other duties as assigned.\nQualifications\nEducation\nAssociate’s degree in a related field of study required, or bachelor’s degree in a related field of study required.\nExperience may be accepted in lieu of a degree.\nLicenses and Credentials\nRelevant professional certifications preferred or required, such as GCIH, GPEN, CISSP, OSCP, or similar credentials.\nExperience\n5-7 years of relevant experience required.\nKnowledge, Skills, and Abilities\nAuthority in cybersecurity concepts within the role’s domain.\nProficient understanding of cybersecurity concepts outside of a specific individual domain.\nExpertise with the tools and solutions supported by the team.\nAbility to apply original and innovative thinking to produce new ideas.\nStrong leadership, communication, and project management skills.\nStrong decision-making skills, with the ability to weigh the relative costs and benefits of potential actions and identify the most appropriate path forward.\n Additional Job Details (if applicable)\nWorking Model Required\nMonday-Friday, Eastern business hours.\nOnsite presence required one day per week.\nFlexibility required for additional onsite days for meetings or business needs, as planned and scheduled.\nRemote workdays require a stable, secure, quiet, and compliant workstation using MGB-provided equipment.\nRemote Type\nHybridWork Location\n399 Revolution DriveScheduled Weekly Hours\n40Employee Type\nRegular Work Shift\nDay (United States of America)Pay Range\n$93,953.60 - $136,739.20/AnnualGrade\n7At Mass General Brigham, we believe in recognizing and rewarding the unique value each team member brings to our organization. Our approach to determining base pay is comprehensive, and any offer extended will take into account your skills, relevant experience if applicable, education, certifications and other essential factors. The base pay information provided offers an estimate based on the minimum job qualifications; however, it does not encompass all elements contributing to your total compensation package. In addition to competitive base pay, we offer comprehensive benefits, career advancement opportunities, differentials, premiums and bonuses as applicable and recognition programs designed to celebrate your contributions and support your professional growth. We invite you to apply, and our Talent Acquisition team will provide an overview of your potential compensation and benefits package. EEO Statement:\n0100 Mass General Brigham Incorporated is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religious creed, national origin, sex, age, gender identity, disability, sexual orientation, military service, genetic information, and/or other status protected under law. We will ensure that all individuals with a disability are provided a reasonable accommodation to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment. To ensure reasonable accommodation for individuals protected by Section 503 of the Rehabilitation Act of 1973, the Vietnam Veteran’s Readjustment Act of 1974, and Title I of the Americans with Disabilities Act of 1990, applicants who require accommodation in the job application process may contact Human Resources at (857)-282-7642. Mass General Brigham Competency Framework\nAt Mass General Brigham, our competency framework defines what effective leadership “looks like” by specifying which behaviors are most critical for successful performance at each job level. The framework is comprised of ten competencies (half People-Focused, half Performance-Focused) and are defined by observable and measurable skills and behaviors that contribute to workplace effectiveness and career success. These competencies are used to evaluate performance, make hiring decisions, identify development needs, mobilize employees across our system, and establish a strong talent pipeline.","description_format":"text","description_chars":9011,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"associate","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Vulnerability Management","Hospitals & Health Systems","Information Security","Health Insurance & Benefits"],"lifecycle":[{"event":"open","at":"2026-08-30T13:11:42Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 70","filings_12m":70,"filings_prev_12m":61,"green_card_filings_12m":0,"median_offered_wage_usd":87500,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":1}],"liveness":{"score":12,"band":"cold","label":"Long shot","p_open":1,"p_active":0.418,"p_room":0.28,"age_days":77,"expected_fill_days":23,"reasons":["conf:0","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-22T06:10:10Z"},"pay":{"stated_usd_annual":136739,"is_top_pay":false},"html_url":"https://alion.io/job/massgeneralbrigham-senior-information-security-analyst-attack-surface-management-lead","json_url":"https://alion.io/job/massgeneralbrigham-senior-information-security-analyst-attack-surface-management-lead.json","meta":{"generated_at":"2026-10-22T12:08:31Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":10426,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-23T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5797},"rest":"https://alion.io/mcp/rest/get_company?id=5797"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fmassgeneralbrigham-senior-information-security-analyst-attack-surface-management-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fmassgeneralbrigham-senior-information-security-analyst-attack-surface-management-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fmassgeneralbrigham-senior-information-security-analyst-attack-surface-management-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/massgeneralbrigham-senior-information-security-analyst-attack-surface-management-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fmassgeneralbrigham-senior-information-security-analyst-attack-surface-management-lead"}]}