Professional, Attack Surface & Exposure Analyst

Zinnov is hiring for the role of Professional, Attack Surface & Exposure Analyst on behalf of our Global MNC MedTech client company a company where technology sits at the centre of everything: powering how the core business operates day to day and shaping the products and digital solutions that will define the future of patient care. This role is part of the companys establishment of their new India Global Capability Centre (GCC) in Bengaluru which will drive enterprise technology, digital transformation and innovation for its global operations and contributing to technology that ultimately helps millions of people around the world.

How you'll make an impact

• Discover and inventory internet-facing, internal, cloud, endpoint, application, and third-party assets using EASM, CAASM, asset-discovery, and cloud-security platforms.
• Operate or analyze platforms such as Microsoft Defender EASM, Cortex Xpanse, CyCognito, Tenable Attack Surface Management, Qualys CSAM, Axonius, JupiterOne, Wiz, Prisma Cloud, or equivalent.
• Correlate asset, vulnerability, threat-intelligence, identity, and business-context data to identify high-risk exposures, shadow IT, misconfigurations, unmanaged assets, and potential attack paths.
• Prioritize remediation using CVSS, EPSS, CISA KEV, exploit availability, asset criticality, internet exposure, compensating controls, and business impact.
• Support attack-path and exposure validation using vulnerability scanners, cloud posture data, identity relationships, penetration-testing evidence, and security assessments.
• Partner with infrastructure, cloud, application, IAM, and asset owners to coordinate remediation, verify closure, and document accepted risk or exceptions.
• Develop dashboards and metrics covering attack-surface coverage, exposure age, critical findings, remediation SLA, asset ownership, and risk-reduction trends.
• Automate discovery, enrichment, deduplication, and reporting using REST APIs, Python, PowerShell, or workflow tooling.
• Support incident and threat investigations by providing asset, ownership, exposure, and attack-path intelligence when required.

What you'll bring

Skills Required

• 3+ years of Experience in cybersecurity, vulnerability management, attack-surface management, exposure management, security operations, or a related discipline.
• Hands-on familiarity with EASM, CAASM, vulnerability-management, CNAPP/CSPM, asset-discovery, or security-monitoring technologies.
• Strong understanding of network, cloud, endpoint, identity, application-security, vulnerability, and asset-management concepts.
• Ability to correlate security findings with business context and prioritize risk using vulnerability, threat, exploitability, and asset-criticality information.
• Working knowledge of CVE/CVSS, EPSS, CISA KEV, attack techniques, security frameworks, and remediation workflows.
• Experience with dashboards/reporting and API or scripting-based automation using Python, PowerShell, or equivalent tools.
• Strong analytical, investigative, documentation, and stakeholder-collaboration skills.
• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related discipline; equivalent experience may be considered.

Preferred

• Experience with public-cloud environments and exposure-management capabilities across AWS, Azure, or GCP.
• Familiarity with threat intelligence, attack-path analysis, identity exposure, cyber risk quantification, or third-party external ratings.
• Security+, CySA+, GSEC, GCIH, CCSP, AZ-500, AWS Security, or comparable certifications.