Attack Surface Analyst

Cyber Search Partners; Greater London; On-site; GBP 55,000 - 90,000; Full time

Job summary

Cyber Search Partners Limited is seeking an Engineer to join its growing external attack surface service. You will examine client internet footprints, validate findings, and help shape playbooks, automation and reporting.

You will work to identify legacy or third-party exposure, provide remediation guidance, and support threat hunts with CTI colleagues. Strong documentation and Linux skills are essential.

Qualifications

• Hands-on recon, OSINT and external attack surface discovery experience.
• Solid grasp of external attack techniques and initial access concepts.
• Strong networking knowledge (HTTP, DNS, TLS) and web security basics.
• Comfortable with Linux and the command line; good documentation habits.

Responsibilities

• Investigate internet-facing assets and validate flagged issues as real and exploitable.
• Define how the service runs: methodology, playbooks, automation and reporting.
• Identify unknown or unmanaged infrastructure and provide remediation guidance.
• Turn investigations into repeatable scripts, checks and processes.
• Report findings to technical teams and security leaders, remotely or in person.
• Support threat hunts and CTI colleagues with hypothesis-led work.

Skills

Recon & OSINT

Attack surface discovery

Vulnerability triage

Exposure analysis

External attack techniques

Networking fundamentals (HTTP, DNS,TLS

Linux/CLI

Documentation

Tools

Shodan

Censys

ASM tooling

Git

API work

Job description

A specialist UK cyber security consultancy is growing its managed external attack surface service and is looking for an Engineer to join the team early on. You’ll look at client organisations the way an attacker would, find what they didn’t know was exposed, and help them fix what really matters.

The role

You’ll investigate internet-facing assets, confirm whether flagged issues are real and exploitable, and turn messy external signals into clear, evidence-backed findings. Because the service is still taking shape, you’ll also help define how it runs: methodology, playbooks, automation and reporting.

What you’ll do

• Discover and track client internet-facing assets: domains, subdomains, IP ranges, cloud services, web apps and certificates
• Find unknown, unmanaged, legacy and third‑party infrastructure
• Safely validate findings such as misconfigurations, exposed services, dangling DNS, leaked credentials and public data exposure
• Assess exploitability, confidence and priority, and write clear remediation advice
• Report findings to technical teams and security leaders, in writing, remotely and in person
• Support hypothesis‑led external threat hunts alongside threat hunting and CTI colleagues
• Turn repeatable investigation work into scripts, checks and documented processes

What you’ll bring

• Hands‑on experience in recon, OSINT, attack surface discovery, vulnerability triage or exposure analysis
• A solid grasp of external attack techniques and initial access
• Good networking knowledge (HTTP, DNS, SMTP, SSH, RDP, SMB, TLS) and web security fundamentals
• Comfortable with Linux and the command line
• Clear written communication and strong documentation habits

Nice to have

• Bug bounty experience (HackerOne, Bugcrowd, Intigriti or similar)
• Python, Bash, Git or API work
• Shodan, Censys, passive DNS, certificate transparency or ASM tooling
• Cloud exposure knowledge across AWS, Azure or GCP
• Background in pentesting, threat hunting, CTI or incident response