Senior Security Engineer Attack Surface Platforms (Remote)

First American; California; Remote; USD 112,000 - 150,000; Full time

Benefits offered by this job

Medical benefits

Dental & vision

401k

PTO / paid sick leave

Employee stock purchase plan

Job summary

First American is seeking a Senior Security Engineer - Attack Surface Platforms in California to lead external attack surface management efforts. You will oversee platform operations, asset discovery, exposure analysis, and remediation workflows for internet-facing assets.

You will collaborate with security and technology teams to validate findings, drive risk reduction, and develop repeatable processes and enhancements across the EASM program.

Qualifications

• Bachelor's degree in Computer Science, Information Technology, Engineering, or related field, or equivalent practical experience.
• 4-6 years of experience in information security, external attack surface management, vulnerability management, cloud security, security operations, or a related technical role.
• Hands-on EASM platform experience preferred, Cortex Xpanse experience strongly preferred.

Responsibilities

• Serve as SME for EASM platform; administer configuration, access, integrations, workflows, reporting, and health.
• Maintain reliable discovery and inventory of internet-facing assets (domains, IPs, hosts, services).
• Validate asset attribution and ownership by correlating findings with business, cloud, network, DNS, and inventory context.
• Analyze external exposures and prioritize remediation based on exposure, exploitability, business importance, and threat intel.
• Lead remediation coordination with cloud, network, infrastructure, apps, and business teams; track progress and verify closure.
• Tune platform policies and alerting to improve signal quality and reduce non-actionable findings; document rationale and results.
• Build integrations between EASM and asset inventory, ticketing, cloud security, and security ops systems.
• Develop automation and platform enhancements using APIs and scripts to improve asset review, triage, reporting, and remediation tracking.
• Produce operational reports on asset coverage, exposure trends, remediation status, and platform health.
• Lead EASM onboarding/reviews for new domains, units, cloud environments, brands, acquisitions.
• Support security investigations and incident response for externally exposed assets; preserve evidence.
• Develop runbooks and standards for EASM operations; guide users and partners on findings validation and remediation.

Skills

EASM platform

Asset discovery

Risk analysis

Cloud platforms

API scripting

Remediation ownership

Communication

Data quality

Education

Bachelor's degree in CS/IT/Engineering

Tools

Cortex Xpanse

Python

PowerShell

Bash

Ticketing systems

Job description

Who We Are

Join a team that puts its People First! Since 1889, First American (NYSE: FAF) has held an unwavering belief in its people. They are passionate about what they do, and we are equally passionate about fostering an environment where all feel welcome, supported, and empowered to be innovative and reach their full potential. Our inclusive, people-first culture has earned our company numerous accolades, including being named to the Fortune 100 Best Companies to Work For list for eleven consecutive years. We have also earned awards as a best place to work for women, diversity and LGBTQ+ employees, and have been included on more than 50 regional best places to work lists. First American will always strive to be a great place to work, for all. For more information, please visit www.careers.firstam.com.

What We Do

The Senior Security Engineer - Attack Surface Platforms serves as the subject matter expert for the organization's external attack surface management (EASM) capability. This role leads platform operations, asset discovery coverage, exposure analysis, and remediation workflows for internet-facing assets. The engineer works across security and technology teams to validate findings, direct risk reduction, improve platform quality, and develop repeatable processes and targeted enhancements.

Essential Functions

• Serve as the technical subject matter expert for our EASM platform. Administer platform configuration, access, integrations, workflows, reporting, and operational health.
• Maintain reliable discovery and inventory of internet-facing assets, including domains, IP addresses, hosts, and services. Review coverage, data quality, changes, and newly observed assets to identify potential gaps or unmanaged exposure.
• Validate asset attribution and ownership by correlating EASM findings with available business, cloud, network, DNS, and inventory context. Identify unknown or potentially unauthorized assets and route them for investigation.
• Analyze external exposures such as vulnerable technologies, misconfigurations, exposed services, and assets that do not meet security standards. Prioritize response using exposure context, exploitability, business importance, and available threat information.
• Lead remediation coordination with cloud, network, infrastructure, application, and business teams. Clarify the risk and recommended action, track progress, verify closure, and expedite urgent or overdue exposures through established processes.
• Tune platform policies, risk settings, alerting, and exception workflows to improve signal quality and reduce duplicate or non-actionable findings. Document the rationale for material changes and validate results after implementation.
• Build and maintain integrations between the EASM platform and relevant asset inventory, ticketing, cloud security, or security operations systems. Troubleshoot data flow, mapping, ownership, and workflow issues with platform administrators and vendors.
• Develop targeted automation and platform enhancements using available APIs, scripts, dashboards, and workflow features to improve asset review, triage, reporting, and remediation tracking.
• Produce operational and management reporting on asset coverage, newly discovered assets, exposure trends, remediation status, recurring issues, and platform health. Explain data limitations and highlight items that require action.
• Lead EASM onboarding and change reviews for new domains, business units, cloud environments, brands, and acquisitions. Ensure discovery and ownership processes are updated as the organization changes.
• Support security investigations and incident response when an externally exposed asset or service may contribute to risk. Preserve relevant platform evidence and coordinate follow-up actions with response teams.
• Develop runbooks and standards for EASM operations. Guide platform users and partner teams on finding validation, ownership, prioritization, and effective remediation.

Working Relationships

Partners with Security Operations, Cloud Engineering, Network Engineering, Infrastructure, application teams, IT asset owners, Security Architecture, and business stakeholders. Works with the EASM vendor and internal platform teams to resolve issues, assess product capabilities, and plan changes that improve external visibility and remediation outcomes.

Knowledge and Skills

• Hands-on experience operating an external attack surface management or attack surface management platform (EASM or CTEM).
• Strong understanding of internet-facing assets, common network services and protocols, DNS, web infrastructure, cloud-hosted resources, and how external exposure can create security risk.
• Experience validating vulnerability, exposure, and misconfiguration findings and prioritizing remediation using technical evidence and business context.
• Working knowledge of at least one major cloud platform, including its core services and terminology; experience across multiple cloud platforms is useful.
• Experience integrating security platforms with asset inventory, ticketing, cloud security, or security operations systems and troubleshooting data quality or workflow issues.
• Ability to use APIs or basic scripting in a language such as Python, PowerShell, or Bash to investigate findings, validate data, and support platform enhancements.
• Ability to establish clear ownership and remediation paths for findings and to communicate risk and recommended actions to technical and nontechnical stakeholders.
• Strong analytical, written, and verbal communication skills; able to manage work independently, guide cross-functional remediation, and provide technical direction to peers.

Typical Education

Generally requires a bachelor's degree in Computer Science, Information Technology, Engineering, or a related field, or equivalent practical experience.

Typical Range of Experience

Typically requires 4-6 years of experience in information security, external attack surface management, vulnerability management, cloud security, security operations, or a related technical role. Hands-on EASM platform experience is required; Cortex Xpanse experience is strongly preferred.

Licenses or Certifications

Candidates must hold at least one foundational cloud or cloud security certification at the time of selection. The certification must demonstrate familiarity with cloud concepts and the core services and terminology of at least one major cloud provider or be broadly applicable across all security domains. Additional certifications or formal credentials in application security, secure software development, vulnerability management, or cloud security are preferred.

Pay Range

Pay Range: $112,400.00 - $149,800.00 AnnuallyThis hiring range is a reasonable estimate of the base pay range for this position at the time of posting. Pay is based on a number of factors which may include job-related knowledge, skills, experience, business requirements and geographic location.

Eligibility and Background

First American will consider for employment all qualified applicants, including those with arrest or conviction records, in a manner consistent with the requirements of applicable state and local laws (e.g., the Los Angeles County Fair Chance Ordinance for Employers and the California Fair Chance Act).

First American intends to conduct a review of an applicant's criminal history in connection with a conditional offer. First American reasonably believes that a criminal history may have a direct, adverse and negative relationship with the following material job duties for this position potentially resulting in the withdrawal of the conditional offer of employment: handling of confidential, proprietary or trade secret information belonging to First American or its customers, administrating or facilitating financial transactions, and the ability to meet customer-imposed criminal history requirements.

What We Offer

By choice, we don't simply accept individuality - we embrace it, we support it, and we thrive on it! Our People First culture is inclusive for all employees - not just because it's the right thing to do, but because it's the key to our success. We are proud to foster an authentic and inclusive workplace For All. You are free and encouraged to bring your entire, unique self to work. First American is an equal opportunity employer in every sense of the term.

Based on eligibility, First American offers a comprehensive benefits package including medical, dental, vision, 401k, PTO/paid sick leave and other great benefits like an employee stock purchase plan.