Director, AI-Driven Attack Surface Management

CNA Insurance; Chicago (IL); On-site; USD 97,000 - 189,000; Full time

Benefits offered by this job

Comprehensive benefits package

Job summary

CNA Insurance is seeking a Consulting Director, Attack Surface Management to lead the strategy, adoption, and governance of automation, AI, and agentic AI across application security, vulnerability management, ethical hacking, and attack surface management programs.

You will oversee evaluation and deployment of AI-centric security solutions, drive enterprise-scale risk remediation, and partner with senior leadership to deliver measurable security outcomes.

Qualifications

• Extensive experience in information security, especially application security and vulnerability management.
• Proven ability to define strategy and governance for AI-enabled security programs.
• Demonstrated leadership with cross-functional collaboration at senior levels.

Responsibilities

• Define strategy for automation, AI, and agentic AI across security domains.
• Evaluate and govern AI-centric security solutions and capabilities.
• Lead risk analysis and drive automation to improve protection and efficiency.
• Develop audit-defensible governance, standards, and playbooks for secure AI adoption.
• Communicate metrics and risk to IT and business stakeholders.

Skills

Vulnerability Management

Application Security

AI/ML

GenAI

LLM

Agentic AI security

Security governance

Risk management

Stakeholder communication

Regulatory awareness (SOX, etc.)

Education

Bachelor’s Degree

Master’s Degree preferred

Tools

AI/ML tooling

Threat modeling tools

Code analysis tools

Job description

CNA Insurance is seeking a Consulting Director, Attack Surface Management to lead the strategy, adoption, and governance of automation, AI, and agentic AI across application security, vulnerability management, ethical hacking, and attack surface management programs.

You will oversee evaluation and deployment of AI-centric security solutions, drive enterprise-scale risk remediation, and partner with senior leadership to deliver measurable security outcomes.