Senior Attack Surface Management Analyst

Job Description SailPoint is seeking a highly technical and forward-thinking Senior Attack Surface Management (ASM) Analyst to be a key pillar in our global ASM program. Our program is a centralized function designed to continuously discover, analyze, and mitigate potential cyber threats before they can be exploited. As a Senior ASM Analyst, you will be a critical technical partner to our ASM Team Lead and broader security and engineering teams. You will navigate complex technical challenges, ensuring our risk recommendations are concise, data-driven, and focused on automation.

The ideal candidate has a deep offensive security mindset, excels at dissecting complex cloud infrastructures, and is passionate about automating asset discovery. This role is fully remote and reports to the Head of Vulnerability Management. Key Responsibilities: Continuous Discovery and Programmatic Asset Attribution Execute and scale continuous discovery processes to map and maintain a real-time, comprehensive inventory of all external-facing and internal digital assets, including domains, IPs, APIs, complex cloud resources (AWS, Azure, GCP), SaaS applications, and Shadow IT.

Develop and implement robust asset attribution models, writing scripts to query asset databases and integrate disparate inventories (CMDB, cloud accounts) into a unified, reliable "single source of truth". Exposure Analysis, Threat Intelligence, and Prioritization: Proactively identify security exposures like misconfigured cloud storage, exposed administrative portals, outdated systems, and vulnerabilities (including emerging zero-days) across our entire attack surface.

Contribute to intelligence-led prioritization efforts by combining vulnerability severity (beyond CVSS), real-world exploit availability (drawing from CISA KEV and other threat intel sources), business criticality, data sensitivity, mapped attack paths, and active threat intelligence to determine "what matters most" and "what to fix first" while uncovering root causes.

Security Validation and Remediation Orchestration: Orchestrate Breach and Attack Simulation (BAS) and Autonomous Pentesting exercises, safely simulating real-world attacks (mapped to MITRE ATT&CK) to validate the efficacy of existing security controls (SIEM, EDR, Firewalls) and prove vulnerability exploitability. Collaborate with Engineering, DevOps, and IT teams to define remediation SLAs, build automated ticketing workflows, and verify fixes through continuous monitoring and programmatic re-scanning.

Support continuous Purple Teaming initiatives, partnering closely with offensive (Red Team) and defensive (SOC/Blue Team) functions to translate attack surface findings into resilient detection rules. Automation, Tooling, and Mentorship: Build and maintain automation scripts and API integrations to streamline asset enrichment, automated scanning, threat intelligence correlation, and ticketing system updates. Evaluate, recommend, and implement cutting-edge ASM and Attack Path mapping platforms to continuously optimize our technical capability stack.

Provide technical leadership and mentorship to junior analysts, fostering deep technical skill development and elevating the team’s overall capabilities. Core Qualifications: 5+ years of progressive, hands-on experience in Attack Surface Management, Vulnerability Management, Penetration Testing, Threat Intelligence, or Security Operations—with at least 1-2 years in a senior or lead capacity.

Advanced Cloud Infrastructure Knowledge: Deep, practical experience securing and querying complex multi-cloud environments (AWS, Azure, or GCP), with a strong grasp of cloud security postures, IAM policies, and cloud-native APIs. Strong Automation & API Scripting Skills: Proven capability to write clean, maintainable scripts (Python, Go, or PowerShell) and utilize REST APIs to automate workflows, parse large JSON datasets, and stitch security tools together. Familiarity with Modern Enterprise Tech Stacks: Microservices, Kubernetes/containers, APIs, and modern CI/CD deployment pipelines.

Direct Experience with ASM & Discovery Tooling: Solid proficiency with leading external attack surface management (EASM) and discovery platforms. Vulnerability & Workflow Tooling: Expertise using vulnerability management suites (e.g., Qualys, CrowdStrike Falcon Spotlight) and translating their outputs into automated remediation workflows. Attacker Mindset & Frameworks: Deep familiarity with the MITRE ATT&CK framework, active threat intelligence (e.g., Recorded Future), and attack path analysis tools.

Outstanding Technical Communication: Track record of distilling highly complex technical exploits, cloud misconfigurations, and systemic risks into clear, actionable executive summaries and stakeholder remediation guides. Additional Experience: Breach & Attack Simulation (BAS): Hands-on experience operating BAS or autonomous pentesting platforms. Cybersecurity AI Application: Familiarity with leveraging AI/ML technologies to enhance asset discovery, automate risk categorization, or defend against AI-driven adversarial attacks.

Industry Certifications: Advanced certs such as CISSP, OSCP, GPEN, GCIH, or CCSK are highly valued. Note: Candidates are required to obtain the AWS Certified Cloud Practitioner or AWS Certified Security - Specialty certification within the first year of employment if they do not already possess it. Join Us: If you are a passionate and strategic cybersecurity professional eager to make a tangible impact in a fast-paced and evolving environment, we encourage you to apply. Help us secure our future and our customers by bringing your expertise to our growing ASM team!

The Path to Success (Milestones): 60-Day Milestones (The "Connecting" Phase): Become fully comfortable with core processes and tools (e.g., Vulnerability scanning and BAS tooling), including analysis, ticketing, and internal workflows. Solidify relationships with key partners across the Enterprise and within Cyber teams. Contribute to asset and domain baselining analysis by auditing public-facing inventory, subdomains, certificates, and IP ranges. 90-Day Milestones (The "Contribution" Phase): Assist with establishing alert routing from ASM tooling.

Perform comprehensive exposure analysis across ASM datasets to publish a risk-prioritized remediation roadmap targeting high-severity public risks. Confidently engage with teams to work through remediation problems and ensure operational flow. Design baseline ASM metrics to be delivered to security leadership. Collaborate with Risk & Governance to formalize ASM SLAs, discovery cadences, and remediation mandates into corporate security policies. 6-Month Milestones (The "Performance" Phase): Optimize tool configuration of ASM tools to reduce scanner noise and false positives.

Become a strong, effective contributor who actively identifies and suggests areas for process improvement. Take the lead on an internal team project, such as establishing runbooks for the ASM team, risk reduction campaign, or lead implementation of a recommended security hardening measure. Operationalize risk-based prioritization correlating findings that impact the company at the vulnerability, configuration, assets exposure, and vendor level. Establish continuous bi-directional validation by integrating ASM intelligence into BAS tooling and Red Team adversary emulation workflows.

12-Month Milestones (The "Ownership" Phase): Partner with Infrastructure and Cloud teams to enforce standard golden images, Infrastructure-as-Code (IaC) security guardrails, and automated stale-asset decommission routines. Collaborate with Risk & Governance team to incorporate ASM controls into existing policies. Scale team capabilities by mentoring junior analysts, defining future ASM technology roadmaps, and authoring program maturity benchmarks. Benefits and Compensation listed vary based on the location of your employment and the nature of your employment with SailPoint.

As a part of the total compensation package, this role may be eligible for the SailPoint Corporate Bonus Plan or a role-specific commission, along with potential eligibility for equity participation. SailPoint maintains broad salary ranges for its roles to account for variations in knowledge, skills, experience, market conditions and locations, as well as reflect SailPoint’s differing products, industries, and lines of business. Candidates are typically placed into the range based on the preceding factors as well as internal peer equity.

We estimate the base salary, for US-based employees, will be in this range from (min-max, USD): $92,200 - $155,406.00 Base salaries for employees based in other locations are competitive for the employee’s home location. Benefits Overview 1. Health and wellness coverage: Medical, dental, and vision insurance 2. Disability coverage: Short-term and long-term disability 3. Life protection: Life insurance and Accidental Death & Dismemberment (AD&D) 4. Additional life coverage options: Supplemental life insurance for employees, spouses, and children 5.

Flexible spending accounts for health care, and dependent care; limited purpose flexible spending account 6. Financial security: 401(k) Savings and Investment Plan with company matching 7. Time off benefits: Flexible vacation policy 8. Holidays: 8 paid holidays annually 9. Sick leave 10. Parental support: Paid parental leave 11. Employee Assistance Program (EAP) and Care Counselors 12. Voluntary benefits: Legal Assistance, Critical Illness, Accident, Hospital Indemnity and Pet Insurance options 13.

Health Savings Account (HSA) with employer contribution SailPoint is an equal opportunity employer and we welcome all qualified candidates to apply to join our team. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, protected veteran status, or any other category protected by applicable law. Alternative methods of applying for employment are available to individuals unable to submit an application through this site because of a disability.

Contact applicationassistance@sailpoint.com or mail to 11120 Four Points Dr, Suite 100, Austin, TX 78726, to discuss reasonable accommodations. NOTE: Any unsolicited resumes sent by candidates or agencies to this email will not be considered for current openings at SailPoint. SailPoint (Nasdaq: SAIL) is defining the new era of adaptive identity security. In a world where non-human identities now significantly outnumber humans, our AI-powered platform unifies identity, security, and data intelligence to protect today’s enterprise from advanced identity-based threats.

We deliver the identity solution that spans both the breadth of identities and the depth of context needed to drive real-time access with confidence. Built on principles like zero-standing privilege and contextualized risk, our SailPoint platform transforms identity from a point of vulnerability into a powerful security advantage. Trusted by many of the world's leading organizations, SailPoint secures the enterprise with intelligent, autonomous identity security.

The employment policy of SailPoint is to provide equal opportunity to all persons, and it is SailPoint’s policy to take affirmative action to employ and advance in employment protected veterans and individuals with disabilities.

It is SailPoint’s policy to recruit, hire, train and promote qualified individuals in all job titles, and ensure that all other personnel actions are administered without regard to race, color, religion, national origin, sex, military and/or veteran status, disability, or other legally protected status, and we will ensure that all employment decisions are based only on valid job requirements. SailPoint does not discriminate on the basis of national origin or citizenship status as provided under the Immigration Reform and Control Act of 1986.

Employees and applicants shall not be subjected to harassment, intimidation, threats, coercion, or discrimination because they have engaged in or may engage in any of the following activities: Filing a complaint; Assisting or participating in an investigation, compliance evaluation, hearing, or any other activity related to the administration of the affirmative action provisions of Section 503, VEVRAA, or any other Federal, State or local law requiring equal opportunity for individuals with disabilities or protected veterans; Opposing any act or practice made unlawful by Section 503, VEVRAA,

or their implementing regulations in this part, or any other Federal, State or local law requiring equal opportunity for individuals with disabilities or protected veterans; or Exercising any other right protected by section 503, VEVRAA or their implementing regulations. SailPoint will also provide reasonable accommodation to known physical or mental limitations of an otherwise qualified employee or applicant for employment, unless the accommodation would impose undue hardship on the operation of our business.

SailPoint’s affirmative action program contains an audit and reporting system which enables us to measure the effectiveness of our program, indicate any need for remedial action, determine the degree to which our objectives have been attained, determine whether protected veterans and individuals with disabilities had had the opportunity to participate in company-sponsored activities, measure our compliance with the program’s specific obligations, and document actions taken to comply with these obligations.

• 5+ years in ASM, Vulnerability Management, Penetration Testing, or Security Operations, with 1-2 years in senior/lead roles
• Deep experience with multi-cloud environments (AWS, Azure, GCP) and strong automation/API scripting skills (Python, Go, PowerShell)
• Proficiency with ASM tools, vulnerability management suites, MITRE ATT&CK framework, and excellent technical communication skills