Director, AI‑Driven Attack Surface & Threat Exposure

CNA Insurance; United States; On-site; USD 97,000 - 189,000; Full time

Benefits offered by this job

Comprehensive benefits package

Job summary

CNA Insurance is seeking a Consulting Director for Attack Surface Management to define strategy, adoption, and governance of automation, AI, and agentic AI across security programs. You will lead enterprise-scale risk identification and remediation with measurable security outcomes and collaborate with senior leadership to prioritize risk and improve operations.

The role emphasizes secure AI development, governance, and cross-functional collaboration, with a focus on threat modeling, code

Qualifications

• Bachelor’s Degree required or equivalent work experience.
• Typically, a minimum of ten years of information security or related work experience in one or more of the following: application security, vulnerability management or exposure management, ethical hacking, penetration testing, attack surface management, security engineering, or security architecture.
• Relevant certifications preferred.

Responsibilities

• Aid in defining and implementing strategy for applying automation, AI, and agentic AI to application security, vulnerability management, ethical hacking, and attack surface management use cases.
• Evaluate, deploy, manage, and govern best-in-class new and existing AI-centric solutions, services, and capabilities relevant to the application security, ethical hacking, and vulnerability management domains.
• Identify, prioritize, and drive high-value outcomes where automation and AI can improve operational effectiveness, speed, scale, and efficiency.
• Develop and contribute to audit-defensible governance, standards, processes, procedures, methodologies, practices, playbooks, etc. for secure AI adoption and use across application security, vulnerability management, and ethical hacking domains.
• Lead identification and risk analysis of the external attack surface through development and continuous improvement of automation to drive effective risk exposure response across the business.
• Create secure AI, including agentic, development practices by establishing and continuously improving reusable skills, prompts, workflows, and guardrails for AI-based tools such that AI generated code adheres to secure coding expectations, including proper input validation, authentication, authorization, secrets handling, logging, error handling, dependency use, and secure design.
• Drive the use of AI to improve threat modeling, code review, and application security testing; vulnerability analysis, prioritization, and remediation; penetration testing and red teaming; and attack surface discovery, risk analysis, and remediation.
• Partner with peer domain leaders and practitioners to understand, align, integrate, collaborate, etc. on AI initiatives that realize value to Cyber Defense, Global Enterprise Security, and the business at large.
• Provides proactive, frequent and consistent communication to key IT and business stakeholders on applicable measures, metrics, KRIs, KPIs, threats, risks, etc. Ensures application security, vulnerability management, ethical hacking outputs, and other attack surface management activities result in proper action, risk management, etc.

Skills

Vulnerability Management

Application Security

AI/GenAI

Threat Management

Penetration Testing

Education

Bachelor’s Degree or equivalent

Master’s Degree preferred

Tools

Scripting

Security Automation

Job description

CNA Insurance is seeking a Consulting Director for Attack Surface Management to define strategy, adoption, and governance of automation, AI, and agentic AI across security programs. You will lead enterprise-scale risk identification and remediation with measurable security outcomes and collaborate with senior leadership to prioritize risk and improve operations.

The role emphasizes secure AI development, governance, and cross-functional collaboration, with a focus on threat modeling, code