Attack Surface Management, Lead Analyst

About the Role

The University of Southern California (USC) is advancing its cybersecurity posture with a renewed focus on resilience, cyber risk management, and threat-informed defense. As a world-class research institution, USC is building a culture of security that supports its academic and research mission in a rapidly evolving threat landscape. This role sits within a newly restructured cybersecurity organization leading this transformation. You’ll join a team focused on scalable, proactive defense strategies, incident preparedness, and operational excellence—working alongside experts deeply committed to service, innovation, and impact.

This is a full-time exempt position, eligible for all of USC’s benefits and perks. The opportunity is remote.

Responsibilities

• Oversee the vulnerability lifecycle management process (e.g., detection, monitoring, reporting, and assessing the impact of vulnerabilities).
• Support regular vulnerability assessments and scans to identify security weaknesses in systems, applications, networks, and OT/IoT environments.
• Develop and implement remediation strategies to address vulnerabilities and minimize the university's attack surface.
• Implement remediation required by audits.
• Engage with DSUs to advise on remediation strategies for vulnerabilities.
• Collaborate with IT teams and stakeholders to validate effective end-to-end vulnerability remediation and maintain a consistent customer experience.
• Collaborate with VM managed service teams and manage daily operations and communications.
• Evaluate vulnerability trends in third-party applications and services and collaborate with managed service providers as needed.
• Serve as an ASM subject matter expert, formulating and prioritizing intelligence requirements according to established risk management frameworks.
• Participate in and influence the roadmap for the university’s vulnerability management program.
• Collaborate on detailed reports on vulnerabilities, their impact, and the status of remediation efforts, and communicate findings to stakeholders.
• Provide expertise to help develop and maintain vulnerability and attack surface management policies, procedures, and best practices for the university.
• Maintain awareness and knowledge of current changes within legal, regulatory, and technology environments which may affect operations.
• Maintain awareness of current university threat intelligence feeds and reports to stay informed about emerging threats and vulnerabilities that may affect the organization's attack surface.
• Maintain knowledge of emerging vulnerabilities, exploits, and remediation techniques.
• Encourage a workplace culture where all employees are valued, value others, and have the opportunity to contribute through their ideas, words, and actions, in accordance with the USC Code of Ethics.

Requirements

• 5 years in attack surface and vulnerability management.
• A bachelor’s degree or combined experience/education as substitute for minimum education.
• Knowledge of the following frameworks: NIST Cybersecurity Framework (NIST CSF), ISO/IEC 27001, MITRE ATT&CK Framework, OWASP Top Ten, CIS Controls, COBIT, SANS Critical Security Controls, PCI DSS, NIST SP 800-53, and ITIL.
• Strong understanding of ASM/vulnerability management, security testing practices, and methodologies.
• Understanding and technical knowledge of Cyber Defense concepts (e.g., incident response, security monitoring, cyber threat intelligence, attack surface and vulnerability management).
• Understanding of Operational Technology environments and security requirements needed to manage the broader attack landscape across the university.
• Experience in building infrastructure and application vulnerability management programs.
• Experience in deploying and operating vulnerability scanning infrastructure and services, and deep understanding of vulnerability scanning platforms.
• Comprehensive knowledge of cloud-native vulnerability practices in AWS, Azure, and SaaS platforms and associated security challenges.
• Ability to assess business risks and recommend suitable cybersecurity measures.
• Experience in managing vulnerability assessment tools.
• Knowledge of system, application, and database hardening techniques.
• Strong communication and interpersonal skills, enabling effective interaction across all organizational levels, along with proven analytical and problem-solving abilities, and exceptional attention to detail.
• Project management experience with a track record of leading complex security initiatives, coupled with the ability to teach and train others effectively.
• Ability to work with teams across the cybersecurity function, with managed service providers, and with IT teams across the university.
• Ability to work evenings, weekends, and holidays as the schedule dictates.

Preferred Qualifications

• 7 years of related experience.
• A bachelor's degree in Information Science, Computer Science, Computer Engineering, or related field(s).
• Experience working in higher education or complex, decentralized environments.
• Certifications such as CISSP, GCIH, GPEN, Security+, or similar.
• Demonstrated commitment to USC’s Unifying Values of integrity, excellence, community, well-being, open communication, and accountability.

Pay

The annual base salary range for this position is $162,315.11 - $201,452.98. When extending an offer of employment, the University of Southern California considers factors such as (but not limited to) the scope and responsibilities of the position, the candidate’s work experience, education/training, key skills, internal peer alignment, federal, state, and local laws, contractual stipulations, grant funding, as well as external market and organizational considerations.

Benefits

USC provides benefits-eligible employees with a broad range of perks to help protect their and their dependents’ health, wealth, and future. Learn more about USC’s comprehensive benefits here.