Professional, Attack Surface & Exposure Analyst

Zinnov Management Consulting; Bengaluru; Hybrid; INR 1,800,000 - 2,800,000; Full time

Job summary

Zinnov is hiring for the role of Professional, Attack Surface & Exposure Analyst in Bengaluru to support a global MedTech client’s new GCC. You will inventory assets across environments, correlate data, and prioritize remediations to reduce risk, working with infra, cloud, IAM, and app teams.

The role emphasizes automation, dashboards, and vulnerability data integration, with a focus on identifying shadow IT, misconfigurations, and high-risk exposures in a complex enterprise setting.

Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related discipline; equivalent experience may be considered.
• 3+ years of experience in cybersecurity, vulnerability management, attack-surface management, exposure management, security operations, or a related discipline.

Responsibilities

• Discover and inventory internet-facing, internal, cloud, endpoint, application, and third-party assets using EASM, CAASM, asset-discovery, and cloud-security platforms.
• Correlate asset, vulnerability, threat-intelligence, identity, and business-context data to identify high-risk exposures, shadow IT, misconfigurations, unmanaged assets, and potential attack paths.
• Prioritize remediation using CVSS, EPSS, CISA KEV, exploit availability, asset criticality, internet exposure, compensating controls, and business impact.
• Develop dashboards and metrics covering attack-surface coverage, exposure age, critical findings, remediation SLA, asset ownership, and risk-reduction trends.
• Automate discovery, enrichment, deduplication, and reporting using REST APIs, Python, PowerShell, or workflow tooling.

Skills

Cybersecurity

Vulnerability management

Attack surface

Cloud security

Automation (Python/PowerShell)

Stakeholder collaboration

Education

Bachelor's degree in Cybersecurity/IT/CS

Tools

Python

PowerShell

REST APIs

Job description

Zinnov is hiring for the role of Professional, Attack Surface & Exposure Analyst on behalf of our Global MNC MedTech client company a company where technology sits at the centre of everything: powering how the core business operates day to day and shaping the products and digital solutions that will define the future of patient care. This role is part of the companys establishment of their new India Global Capability Centre (GCC) in Bengaluru which will drive enterprise technology, digital transformation and innovation for its global operations and contributing to technology that ultimately helps millions of people around the world.

How you'll make an impact

• Discover and inventory internet-facing, internal, cloud, endpoint, application, and third-party assets using EASM, CAASM, asset-discovery, and cloud-security platforms.
• Operate or analyze platforms such as Microsoft Defender EASM, Cortex Xpanse, CyCognito, Tenable Attack Surface Management, Qualys CSAM, Axonius, JupiterOne, Wiz, Prisma Cloud, or equivalent.
• Correlate asset, vulnerability, threat-intelligence, identity, and business-context data to identify high-risk exposures, shadow IT, misconfigurations, unmanaged assets, and potential attack paths.
• Prioritize remediation using CVSS, EPSS, CISA KEV, exploit availability, asset criticality, internet exposure, compensating controls, and business impact.
• Support attack-path and exposure validation using vulnerability scanners, cloud posture data, identity relationships, penetration-testing evidence, and security assessments.
• Partner with infrastructure, cloud, application, IAM, and asset owners to coordinate remediation, verify closure, and document accepted risk or exceptions.
• Develop dashboards and metrics covering attack-surface coverage, exposure age, critical findings, remediation SLA, asset ownership, and risk-reduction trends.
• Automate discovery, enrichment, deduplication, and reporting using REST APIs, Python, PowerShell, or workflow tooling.
• Support incident and threat investigations by providing asset, ownership, exposure, and attack-path intelligence when required.

What you'll bring

Skills Required

• 3+ years of Experience in cybersecurity, vulnerability management, attack-surface management, exposure management, security operations, or a related discipline.
• Hands-on familiarity with EASM, CAASM, vulnerability-management, CNAPP/CSPM, asset-discovery, or security-monitoring technologies.
• Strong understanding of network, cloud, endpoint, identity, application-security, vulnerability, and asset-management concepts.
• Ability to correlate security findings with business context and prioritize risk using vulnerability, threat, exploitability, and asset-criticality information.
• Working knowledge of CVE/CVSS, EPSS, CISA KEV, attack techniques, security frameworks, and remediation workflows.
• Experience with dashboards/reporting and API or scripting-based automation using Python, PowerShell, or equivalent tools.
• Strong analytical, investigative, documentation, and stakeholder-collaboration skills.
• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related discipline; equivalent experience may be considered.

Preferred

• Experience with public-cloud environments and exposure-management capabilities across AWS, Azure, or GCP.
• Familiarity with threat intelligence, attack-path analysis, identity exposure, cyber risk quantification, or third-party external ratings.
• Security+, CySA+, GSEC, GCIH, CCSP, AZ-500, AWS Security, or comparable certifications.