External Attack Surface Analyst (Contract) - Sydney

NCS; Sydney; On-site; AUD 120,000 - 150,000; Full time

Job summary

NCS Australia is seeking a Security Analyst to join for an initial short-term contract in Sydney, Oct–Dec 2026, with possible extensions. You will analyze raw discovery data across internet-facing infrastructure to build a validated, risk-actionable External Exposure Baseline and bridge discovery with governance.

Responsibilities include asset discovery, normalization, ownership mapping, risk prioritization, remediation planning, and executive reporting for senior cybersecurity leadership.

Qualifications

• Proven track record in external attack surface analysis or exposure risk assessment.
• Experience consolidating datastores from multiple security tools for governance.
• Strong understanding of asset discovery lifecycle and threat modeling.

Responsibilities

• Attack Surface Data Analysis: analyze external exposure data to establish baseline.
• Asset Discovery & Normalization: consolidate data from multiple engines into a single source of truth.
• Inventory Reconciliation & Ownership Mapping: identify ownership gaps and unmanaged services.
• Stakeholder Engagement: collaborate with teams to validate relationships and criticality.
• Risk Assessment & Prioritization: prioritize remediation based on threat and impact.
• Treatment & Remediation Planning: define actions, ownership, and decommissioning if needed.
• Documentation & Governance: maintain audit-ready findings and evidence.
• Executive Reporting: deliver insights on exposure trends and remediation progress.

Skills

EASM

Data manipulation

Asset governance

Stakeholder engagement

Network security

Job description

NCS Australia is seeking a Security Analyst to join for an initial short-term contract in Sydney, Oct–Dec 2026, with possible extensions. You will analyze raw discovery data across internet-facing infrastructure to build a validated, risk-actionable External Exposure Baseline and bridge discovery with governance.

Responsibilities include asset discovery, normalization, ownership mapping, risk prioritization, remediation planning, and executive reporting for senior cybersecurity leadership.