Strategic Exposure Management Lead

Federal Reserve Bank of New York; Richmond (VA); On-site; USD 137,000 - 222,000; Full time

Job summary

The Federal Reserve Bank of Richmond is seeking an Exposure Management Senior Advisor to continuously identify, assess, and reduce cyber exposures across on‑premises, cloud, and hybrid environments. This role integrates attack surface discovery, vulnerability insights, misconfiguration analysis, identity exposure review, and business context to provide a unified view of cyber risk.

Working closely with the Product Manager, this role translates program strategy and user needs into actionable

Qualifications

• Strong understanding of Exposure Management concepts including attack surface management, exposure prioritisation, cloud security posture, identity risk, and Exposure Management principles.
• Experience with CTEM-aligned workflows or continuous risk-reduction programs.
• Ability to analyse complex exposure data and translate it into actionable risk insights.

Responsibilities

• Own platform operations and health of the Exposure Management SaaS platform, ensuring uptime, performance, and user access.
• Coordinate integration of exposure data sources including vulnerability scanners, CSPM, CIEM, EASM, asset inventories, and threat intel feeds.
• Discover, map, and inventory external and internal attack surfaces across cloud, on-premises, network, application, and SaaS environments.
• Contribute to scoping CTEM cycles and defining focus areas, maintain standards and documentation.
• Serve as liaison with the SaaS vendor and manage licensing, usage, and roadmap discussions.

Skills

Exposure management

ASM tooling

CTEM workflows

Risk analysis

SaaS platform admin

APIs & data pipelines

Stakeholder management

Cloud security

Tools

ASM platforms

CSPM

CIEM

VM scanners

EASM

Job description

The Federal Reserve Bank of Richmond is seeking an Exposure Management Senior Advisor to continuously identify, assess, and reduce cyber exposures across on‑premises, cloud, and hybrid environments. This role integrates attack surface discovery, vulnerability insights, misconfiguration analysis, identity exposure review, and business context to provide a unified view of cyber risk.

Working closely with the Product Manager, this role translates program strategy and user needs into actionable