Senior ASM Lead: Attack Surface & Risk Prioritization

Mass General Brigham; Somerville (MA); Hybrid; USD 94,000 - 137,000; Full time

Job summary

Mass General Brigham in Somerville, MA is seeking a Senior Information Security Analyst to lead the Attack Surface Management function, coordinating vulnerability discovery, exposure analysis, and adversary simulation across the organization.

The role emphasizes translating complex findings into risk narratives, guiding engineering teams, and prioritizing remediation based on exploitability and business impact, with a hybrid onsite schedule.

Qualifications

• Bachelor’s degree or Associate’s degree required; combination may be considered.
• 5–7 years of relevant experience in information security.
• Relevant certifications preferred or required (GCIH, GPEN, CISSP, OSCP).
• Experience with vulnerability management and exploit validation.
• Strong communication and risk-based prioritization skills.

Responsibilities

• Support vulnerability discovery and remediation prioritization.
• Analyze exposed assets and translate data into risk-reduction recommendations.
• Coordinate penetration testing activities and validate findings.
• Coordinate attack simulation and adversary emulation activities.
• Partner with teams to integrate findings into detections and threat hunting.
• Document ASM processes, findings, and remediation plans.
• Communicate findings clearly to stakeholders.

Skills

Vulnerability discovery

Attack surface analysis

Penetration testing

Threat modeling

Incident response

Documentation

Education

Associate’s degree in a related field

Bachelor’s degree in a related field

Tools

GCIH

GPEN

CISSP

OSCP

Job description

Mass General Brigham in Somerville, MA is seeking a Senior Information Security Analyst to lead the Attack Surface Management function, coordinating vulnerability discovery, exposure analysis, and adversary simulation across the organization.

The role emphasizes translating complex findings into risk narratives, guiding engineering teams, and prioritizing remediation based on exploitability and business impact, with a hybrid onsite schedule.