Location: US:
Work Type: Full Time
FTE: 1.00
Shift: Day
Hours: 8
SUMMARY OF POSITION:Performs cybersecurity vulnerability and exposure assessments across enterprise systems, applications, cloud platforms, identities, networks, and externally facing assets. Identifies, analyzes, prioritizes, and validates vulnerabilities, security weaknesses, attack-surface exposures, and control gaps to support measurable risk reduction. This senior-level position operates under minimal direction and provides mentoring and technical guidance to less experienced analysts.
Essential Functions1.
Assess and map enterprise exposure - evaluate vulnerabilities, misconfigurations, control gaps, and attack paths across infrastructure, applications, cloud platforms, identities, externally facing assets, and emerging AI systems and integrations.
2.
Drive threat-informed prioritization - apply adversary intelligence, MITRE ATT&CK-mapped techniques, exploitability data, asset criticality, and business context to focus exposure reduction where it matters most.
3.
Deliver clear findings and remediation guidance - conduct exposure analysis, produce actionable recommendations, and partner with asset owners and technology teams to drive measurable exposure reduction.
4.
Evaluate control effectiveness - assess whether existing controls adequately address identified exposures; apply MITRE D3FEND to identify and evaluate compensating or mitigating controls, and validate that control decisions reduce exposure as intended.
5.
Partner with the threat intelligence team - monitor adversary activity, emerging exposures, frontier AI-enabled threats, and industry developments; align exposure prioritization with MITRE ATT&CK-mapped adversary targeting and active campaigns to ensure remediation sequencing reflects realistic threat context; provide technical mentoring to developing analysts.
MINIMUM QUALIFICATION(s):- Bachelor's Degree plus five (5) years of related experience, or an equivalent combination of education and experience.
PREFERRED QUALIFICATION(s):- Degree in a Cyber Security, Computer Science, or Information Technology or related discipline.
- Experience with vulnerability management, exposure management, attack-surface management, cloud security, threat intelligence, security operations, or penetration testing.
- Relevant cybersecurity or information technology certification.
Penn State Health offers an exceptional benefits package including medical, dental and vision with no waiting period as well as a Total Rewards Program that highlights a few of the many additional offerings below:- Be Well with Employee Wellness Programs, and Fitness Discounts (University Fitness Center, Peloton).
- Be Balanced with Generous Paid Time Off, Personal Time, and Paid Parental Leave.
- Be Secured with Retirement, Extended Illness Bank, Life Insurance, and Identity Theft Protection.
- Be Rewarded with Competitive Pay, Tuition Reimbursement, and PAWS UP employee recognition program.
- Be Supported by the HR Solution Center, Learning and Organizational Development and Virtual Benefits Orientation, Employee Exclusive Concierge Service for scheduling.
Union: Non Bargained
