Director of Attack Surface Engineering

Iceberg; Dublin; On-site; EUR 150,000 - 190,000; Full time

Job summary

Iceberg in Ireland is seeking a Director-level leader to build and run a Cyber Exposure Management capability. You will report directly to the CISO and reshape how the organisation understands and reduces cyber exposure across cloud, infrastructure, identity, and external attack surface.

This role focuses on engineering-driven risk reduction, translating complex exposure into actionable risk for senior stakeholders, and driving remediation at scale with engineering and platform teams.

Qualifications

• Strong experience in exposure management, vulnerability management or security engineering.
• Deep technical understanding of cloud, infrastructure, identity and application security.
• Proven track record of driving remediation and measurable risk reduction.
• Experience building or transforming security capabilities in complex environments.
• Ability to influence across a large organisation with an engineering mindset.

Responsibilities

• Define and lead how exposure is measured, prioritised and tracked across the enterprise.
• Drive remediation at scale with engineering and platform teams to reduce exposure.
• Translate complex technical exposure into clear, actionable risk for senior stakeholders.
• Shape prioritisation and investment decisions across the organisation.
• Collaborate with engineering, architecture, cloud, identity and security teams in a cross-functional environment.

Skills

Exposure management

Vulnerability management

Security engineering

Cloud security

Identity security

Application security

Remediation

Risk reduction

Stakeholder comms

Cross-functional leadership

Job description

I am working directly with the CISO of a highly regulated organisation and am kicking off a search to hire a Director-level leader to build and run a new Cyber Exposure Management capability/function. This individual will report directly to the CISO.

This person will be responsible for reshaping how the organisation understands and reduces cyber exposure across cloud, infrastructure, applications, identity and external attack surface, moving from fragmented vulnerability activity to a single, engineering-led exposure reduction model.

As the attack landscape evolves at pace, driven by automation, AI-enabled adversaries and increasingly industrialised exploitation, this role is about ensuring the organisation can see, understand and reduce real-world exposure quicker than attackers are finding it. It is about shifting from reactive vulnerability management to continuous, intelligent, engineering-driven risk reduction.

You will define and lead how exposure is measured, prioritised and tracked across the enterprise, bringing together vulnerability, cloud, identity and attack surface data into a single, living view of risk. You also will drive remediation at scale with engineering and platform teams, ensuring exposure is actively reduced rather than simply recorded.

You will also translate complex technical exposure into clear, actionable risk for senior stakeholders, shaping prioritisation and investment decisions across the organisation and working closely with engineering, architecture, cloud, identity and security teams in a highly cross-functional environment.

To be considered for this position, you must have strong experience in exposure management, vulnerability management or security engineering, with deep technical understanding of cloud, infrastructure, identity and application security. You should have a proven track record of driving remediation and measurable risk reduction, experience building or transforming security capabilities in complex environments and the ability to influence across a large organisation with a strong engineering mindset/knowledge.