[Hiring] Lead Analyst, Attack Surface Management @University of Southern California

Role Description

The University of Southern California (USC) is advancing its cybersecurity posture with a renewed focus on resilience, cyber risk management, and threat-informed defense. As a world-class research institution, USC is building a culture of security that supports its academic and research mission in a rapidly evolving threat landscape.

This role sits within a newly restructured cybersecurity organization that’s leading this transformation. You’ll join a team focused on scalable, proactive defense strategies, incident preparedness, and operational excellence—working alongside experts who are deeply committed to service, innovation, and impact.

If you’re driven by purpose, thrive in complexity, and want to help shape the future of cybersecurity at a leading university, we invite you to bring your leadership to the table.

Qualifications

• 5 years in attack surface and vulnerability management.
• A bachelor’s degree or combined experience/education as substitute for minimum education.
• Knowledge of the following frameworks:
  • NIST Cybersecurity Framework (NIST CSF)
  • ISO/IEC 27001
  • MITRE ATT&CK Framework
  • OWASP Top Ten
  • CIS Controls
  • COBIT
  • SANS Critical Security Controls
  • PCI DSS
  • NIST SP 800-53
  • ITIL
• Strong understanding of ASM/vulnerability management, security testing practices, and methodologies.
• Understanding and technical knowledge of Cyber Defense concepts (e.g., incident response, security monitoring, cyber threat intelligence, attack surface and vulnerability management).
• Understanding of Operational Technology environments and security requirements needed to manage the broader attack landscape across the university.
• Experience in building infrastructure and application vulnerability management programs.
• Experience in deploying and operating vulnerability scanning infrastructure and services and deep understanding of vulnerability scanning platforms.
• Comprehensive knowledge of cloud-native vulnerability practices in AWS, Azure, and SaaS platforms and associated security challenges.
• Ability to assess business risks and recommend suitable cybersecurity measures.
• Experience in managing vulnerability assessment tools.
• Knowledge of system, application, and database hardening techniques.
• Strong communication and interpersonal skills, enabling effective interaction across all organizational levels.
• Proven analytical and problem-solving abilities, and exceptional attention to detail.
• Project management experience with a track record of leading complex security initiatives, coupled with the ability to teach and train others effectively.
• Ability to work with teams across the cybersecurity function, with managed service providers, and with IT teams across the university.
• Ability to work evenings, weekends, and holidays as the schedule dictates.

Requirements

• 7 years of related experience (preferred).
• A bachelor's degree or combined experience/education as substitute for minimum education (preferred).
• Experience working in higher education or complex, decentralized environments (preferred).
• CISSP, GCIH, GPEN, Security+, or similar (preferred).

Benefits

• The annual base salary range for this position is $162,315.11-$201,452.98.
• USC provides benefits-eligible employees with a broad range of perks to help protect their and their dependents’ health, wealth, and future.