Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 65 days ago

AI Attack Surface and Threat Exposure Management Consulting Director

cna114 open roles

Pay
$97,000 – $189,000 a year
Where
Chicago IL USA
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowAI Attack Surface and Threat Exposure Management Consulting Directorcna · Chicago IL USA

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on cna's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

8.1% of postings close within 7 days. Measured by our own scanner across the market. cna postings stay open a median of 7 days.

Share of postings closed within
  1. 1.7%1 day
  2. 3.6%3 days
  3. 8.1%7 days
  4. 15.0%14 days
  5. 33.9%30 days
This job: posted 65 days ago

cna median: 7 days open

The posting

You have a clear vision of where your career can go. And we have the leadership to help you get there. At CNA, we strive to create a culture in which people know they matter and are part of something important, ensuring the abilities of all employees are used to their fullest potential.

The Consulting Director, Attack Surface Management defines strategy, adoption, and governance of automation, AI, and agentic AI across application security, vulnerability management, ethical hacking, and attack surface management programs. Oversees evaluation and deployment of AI-centric security solutions while establishing audit-defensible standards, processes, and secure AI development practices. Drives enterprise-scale identification, analysis, and remediation of external attack surface risk through advanced automation, analytics, and AI-enabled capabilities. Partners with senior leadership and cross-functional teams to prioritize risk, improve operational efficiency, and deliver measurable security outcomes. Provides expert guidance, metrics, and reporting to ensure effective risk management, regulatory alignment, and continuous program maturity.

JOB DESCRIPTION:

Essential Duties & Responsibilities

Performs a combination of duties in accordance with departmental guidelines:

  • Aid in defining and implementing strategy for applying automation, AI, and agentic AI to application security, vulnerability management, ethical hacking, and attack surface management use cases.
  • Evaluate, deploy, manage, and govern best-in-class new and existing AI-centric solutions, services, and capabilities relevant to the application security, ethical hacking, and vulnerability management domains.
  • Identify, prioritize, and drive high-value outcomes where automation and AI can improve operational effectiveness, speed, scale, and efficiency.
  • Develop and contribute to audit-defensible governance, standards, processes, procedures, methodologies, practices, playbooks, etc. for secure AI adoption and use across application security, vulnerability management, and ethical hacking domains.
  • Lead identification and risk analysis of the external attack surface through development and continuous improvement of automation to drive effective risk exposure response across the business.
  • Create secure AI, including agentic, development practices by establishing and continuously improving reusable skills, prompts, workflows, and guardrails for AI-based tools such that AI generated code adheres to secure coding expectations, including proper input validation, authentication, authorization, secrets handling, logging, error handling, dependency use, and secure design.
  • Drive the use of AI to improve threat modeling, code review, and application security testing; vulnerability analysis, prioritization, and remediation; penetration testing and red teaming; and attack surface discovery, risk analysis, and remediation.
  • Partner with peer domain leaders and practitioners to understand, align, integrate, collaborate, etc. on AI initiatives that realize value to Cyber Defense, Global Enterprise Security, and the business at large.
  • Provides proactive, frequent and consistent communication to key IT and business stakeholders on applicable measures, metrics, KRIs, KPIs, threats, risks, etc. Ensures application security, vulnerability management, ethical hacking outputs, and other attack surface management activities result in proper action, risk management, etc.

May perform additional duties as assigned.

Reporting Relationship

Typically reports to Director or above.

Skills, Knowledge & Abilities

  • In depth understanding of Vulnerability Management, Application Security, Cloud Security, Ethical Hacking, Threat Management, and Security Remediation programs and operations.
  • Strong working knowledge of AI/ML, GenAI, LLM, and agentic AI security concepts, common attack/defense techniques, and use to solve application security, vulnerability management, and ethical hacking domain problems.
  • Demonstrated experience developing and maturing service, tooling, and process automation.
  • Demonstrated experience in software development and/or scripting.
  • Strong understanding of security vulnerabilities and threats and industry standard methodologies of risk managing exposures effectively.
  • Superior analytical and problem-solving skills and the ability to effectively communicate highly technical information to all audiences.
  • Proven ability to interact effectively with senior business leadership to effectively address vulnerabilities and threats in a priority manner.
  • Working knowledge of regulations (e.g., SOX, privacy, etc.) and internal controls as they apply to IT. Routinely stays up to date on current best practices / trends to identify, document, and drive resolution of security exposures through independent and collaborative industry research.
  • Proven ability to influence change and drive the adoption of automation, AI, and agentic AI to applicable domain programs and teams.
  • Ability to work extremely well under pressure while maintaining a professional image and approach.

Education & Experience

  • Bachelor’s Degree required or equivalent work experience. Master’s Degree in Computer Science or technical field preferred.
  • Typically, a minimum of ten years of information security or related work experience in one or more of the following: application security, vulnerability management or exposure management, ethical hacking, penetration testing, attack surface management, security engineering, or security architecture.
  • Relevant certifications preferred.

#LI-Hybrid

#LI-DM1

In certain jurisdictions, CNA is legally required to include a reasonable estimate of the compensation for this role. In District of Columbia, California, Colorado, Connecticut, Illinois, Maryland, Massachusetts, New York and Washington, the national base pay range for this job level is $97,000 to $189,000 annually. Salary determinations are based on various factors, including but not limited to, relevant work experience, skills, certifications and location. CNA offers a comprehensive and competitive benefits package to help our employees – and their family members – achieve their physical, financial, emotional and social wellbeing goals. For a detailed look at CNA’s benefits, please visit cnabenefits.com.

CNA utilizes AI-enabled technology during the recruiting process. For more information, please visit our careers page.

CNA is committed to providing reasonable accommodations to qualified individuals with disabilities in the recruitment process. To request an accommodation, please contact [email protected]

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against cna's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on cna's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    cna's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.