Iceberg
Director of Attack Surface Engineering
Get notified of more jobs like this · No spam, ever
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Director of Attack Surface Engineering
London - Hybrid (3 days/week onsite)
I am working directly with the CISO of a highly regulated organisation and am kicking off a search to hire a Director-level leader to build and run a new Cyber Exposure Management capability/function. This individual will report directly to the CISO.
This person will be responsible for reshaping how the organisation understands and reduces cyber exposure across cloud, infrastructure, applications, identity and external attack surface, moving from fragmented vulnerability activity to a single, engineering-led exposure reduction model.
As the attack landscape evolves at pace, driven by automation, AI-enabled adversaries and increasingly industrialised exploitation, this role is about ensuring the organisation can see, understand and reduce real-world exposure quicker than attackers are finding it. It is about shifting from reactive vulnerability management to continuous, intelligent, engineering-driven risk reduction.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
You will define and lead how exposure is measured, prioritised and tracked across the enterprise, bringing together vulnerability, cloud, identity and attack surface data into a single, living view of risk. You also will drive remediation at scale with engineering and platform teams, ensuring exposure is actively reduced rather than simply recorded.
You will also translate complex technical exposure into clear, actionable risk for senior stakeholders, shaping prioritisation and investment decisions across the organisation and working closely with engineering, architecture, cloud, identity and security teams in a highly cross-functional environment.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
To be considered for this position, you must have strong experience in exposure management, vulnerability management or security engineering, with deep technical understanding of cloud, infrastructure, identity and application security. You should have a proven track record of driving remediation and measurable risk reduction, experience building or transforming security capabilities in complex environments and the ability to influence across a large organisation with a strong engineering mindset/knowledge.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Location